{"id":"CVE-2024-50241","aliases":["BELL-CVE-2024-50241","DEBIAN-CVE-2024-50241","EUVD-2024-45158","GHSA-x9gg-ww2m-r7gj","OESA-2024-2491","OESA-2024-2492","OESA-2024-2493","OESA-2024-2494","SUSE-SU-2026:24550-1","SUSE-SU-2026:5091-1","UBUNTU-CVE-2024-50241","openSUSE-SU-2024:14500-1","openSUSE-SU-2025:14705-1"],"status":"published","title":"NFSD: Initialize struct nfsd4_copy earlier","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct nfsd4_copy earlier\n\nEnsure the refcount and async_copies fields are initialized early.\ncleanup_async_copy() will reference these fields if an error occurs\nin nfsd4_copy(). If they are not correctly initialized, at the very\nleast, a refcount underflow occurs.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00474,"percentile":0.41317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2024-11-09T10:14:51Z","modified":"2026-11-10T02:49:45Z","fixes":[{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.11.7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.11.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.11.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3"},{"fixed":"6.11.7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.7-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.103.0.184.oe2203sp1"}]}],"bundled":37},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-57.0.0.59.oe2403"}]}],"bundled":79},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-238.0.0.137.oe2203sp4"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-238.0.0.140.oe2203sp3"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.55.1"}]}],"bundled":1056},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.55.1.159998.21.42"}]}],"bundled":1056},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.55.1"}]}],"bundled":1056},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.55.1"}]}],"bundled":1056},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1.150700.17.51.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.90.1"}]}],"bundled":1077},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35","5.4.0-33.37","5.4.0-37.41","5.4.0-39.43","5.4.0-40.44","5.4.0-42.46","5.4.0-45.49","5.4.0-47.51","5.4.0-48.52","5.4.0-51.56","5.4.0-52.57","5.4.0-53.59","5.4.0-54.60","5.4.0-56.62","5.4.0-58.64","5.4.0-59.65","5.4.0-60.67","5.4.0-62.70","5.4.0-64.72","5.4.0-65.73","5.4.0-66.74","5.4.0-67.75","5.4.0-70.78","5.4.0-71.79","5.4.0-72.80","5.4.0-73.82","5.4.0-74.83","5.4.0-77.86","5.4.0-80.90","5.4.0-81.91","5.4.0-84.94","5.4.0-86.97","5.4.0-88.99","5.4.0-89.100","5.4.0-90.101","5.4.0-91.102","5.4.0-92.103","5.4.0-94.106","5.4.0-96.109","5.4.0-97.110","5.4.0-99.112","5.4.0-100.113","5.4.0-104.118","5.4.0-105.119","5.4.0-107.121","5.4.0-109.123","5.4.0-110.124","5.4.0-113.127","5.4.0-117.132","5.4.0-120.136","5.4.0-121.137","5.4.0-122.138","5.4.0-124.140","5.4.0-125.141","5.4.0-126.142","5.4.0-128.144","5.4.0-131.147","5.4.0-132.148","5.4.0-135.152","5.4.0-136.153","5.4.0-137.154","5.4.0-139.156","5.4.0-144.161","5.4.0-146.163","5.4.0-147.164","5.4.0-148.165","5.4.0-149.166","5.4.0-150.167","5.4.0-152.169","5.4.0-153.170","5.4.0-155.172","5.4.0-156.173","5.4.0-159.176","5.4.0-162.179","5.4.0-163.180","5.4.0-164.181","5.4.0-165.182","5.4.0-166.183","5.4.0-167.184","5.4.0-169.187","5.4.0-170.188","5.4.0-171.189","5.4.0-172.190","5.4.0-173.191","5.4.0-174.193","5.4.0-176.196","5.4.0-177.197","5.4.0-181.201","5.4.0-182.202","5.4.0-186.206","5.4.0-187.207","5.4.0-189.209","5.4.0-190.210","5.4.0-192.212","5.4.0-193.213","5.4.0-195.215","5.4.0-196.216","5.4.0-198.218","5.4.0-200.220","5.4.0-202.222","5.4.0-204.224","5.4.0-205.225","5.4.0-208.228","5.4.0-211.231","5.4.0-212.232","5.4.0-214.234","5.4.0-215.235","5.4.0-216.236","5.4.0-218.238","5.4.0-219.239","5.4.0-220.240","5.4.0-221.241","5.4.0-222.242","5.4.0-223.243","5.4.0-224.244","5.4.0-225.245","5.4.0-227.247","5.4.0-228.248","5.4.0-229.249","5.4.0-230.250","5.4.0-231.251","5.4.0-233.253","5.4.0-234.254","5.4.0-238.258","5.4.0-241.261","5.4.0-242.262","5.4.0-244.264","5.4.0-245.265"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.8-1.1"}]}],"bundled":486},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kernel-source-longterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.11-1.1"}]}],"bundled":504}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/059434d23c4578d9d02efb92d848ea21bc640112","tags":["web"]},{"url":"https://git.kernel.org/stable/c/7267625baf365a969f1b25ded6f07b64bc90ec5b","tags":["web"]},{"url":"https://git.kernel.org/stable/c/c3074003fa6837c2b89a34d8d12d9463b59d22d6","tags":["web"]},{"url":"https://git.kernel.org/stable/c/421f1a2a1afb47d88de09457ef7687e1df7bc997","tags":["web"]},{"url":"https://git.kernel.org/stable/c/e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1","tags":["Mailing List","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/63fab04cbd0f96191b6e5beedc3b643b01c15889","tags":["Mailing List","Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50241","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x9gg-ww2m-r7gj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-50241","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50241.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-50241","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49952","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50062","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50179","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50202","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53066","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50024","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50031","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50166","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50299","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53055","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53089","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50301","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2494","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624550-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1232383","tags":["report"]},{"url":"https://bugzilla.suse.com/1233187","tags":["report"]},{"url":"https://bugzilla.suse.com/1233565","tags":["report"]},{"url":"https://bugzilla.suse.com/1244337","tags":["report"]},{"url":"https://bugzilla.suse.com/1246086","tags":["report"]},{"url":"https://bugzilla.suse.com/1248354","tags":["report"]},{"url":"https://bugzilla.suse.com/1250656","tags":["report"]},{"url":"https://bugzilla.suse.com/1255222","tags":["report"]},{"url":"https://bugzilla.suse.com/1256632","tags":["report"]},{"url":"https://bugzilla.suse.com/1257737","tags":["report"]},{"url":"https://bugzilla.suse.com/1258184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264022","tags":["report"]},{"url":"https://bugzilla.suse.com/1264024","tags":["report"]},{"url":"https://bugzilla.suse.com/1264267","tags":["report"]},{"url":"https://bugzilla.suse.com/1264985","tags":["report"]},{"url":"https://bugzilla.suse.com/1267203","tags":["report"]},{"url":"https://bugzilla.suse.com/1267238","tags":["report"]},{"url":"https://bugzilla.suse.com/1267373","tags":["report"]},{"url":"https://bugzilla.suse.com/1267681","tags":["report"]},{"url":"https://bugzilla.suse.com/1267720","tags":["report"]},{"url":"https://bugzilla.suse.com/1269264","tags":["report"]},{"url":"https://bugzilla.suse.com/1269364","tags":["report"]},{"url":"https://bugzilla.suse.com/1269532","tags":["report"]},{"url":"https://bugzilla.suse.com/1269655","tags":["report"]},{"url":"https://bugzilla.suse.com/1269798","tags":["report"]},{"url":"https://bugzilla.suse.com/1271349","tags":["report"]},{"url":"https://bugzilla.suse.com/1272261","tags":["report"]},{"url":"https://bugzilla.suse.com/1272296","tags":["report"]},{"url":"https://bugzilla.suse.com/1273292","tags":["report"]},{"url":"https://bugzilla.suse.com/1273557","tags":["report"]},{"url":"https://bugzilla.suse.com/1273803","tags":["report"]},{"url":"https://bugzilla.suse.com/1273805","tags":["report"]},{"url":"https://bugzilla.suse.com/1273809","tags":["report"]},{"url":"https://bugzilla.suse.com/1273839","tags":["report"]},{"url":"https://bugzilla.suse.com/1273880","tags":["report"]},{"url":"https://bugzilla.suse.com/1273970","tags":["report"]},{"url":"https://bugzilla.suse.com/1273999","tags":["report"]},{"url":"https://bugzilla.suse.com/1274080","tags":["report"]},{"url":"https://bugzilla.suse.com/1274082","tags":["report"]},{"url":"https://bugzilla.suse.com/1274261","tags":["report"]},{"url":"https://bugzilla.suse.com/1274292","tags":["report"]},{"url":"https://bugzilla.suse.com/1274550","tags":["report"]},{"url":"https://bugzilla.suse.com/1274902","tags":["report"]},{"url":"https://bugzilla.suse.com/1274949","tags":["report"]},{"url":"https://bugzilla.suse.com/1275524","tags":["report"]},{"url":"https://bugzilla.suse.com/1275568","tags":["report"]},{"url":"https://bugzilla.suse.com/1275575","tags":["report"]},{"url":"https://bugzilla.suse.com/1275671","tags":["report"]},{"url":"https://bugzilla.suse.com/1275672","tags":["report"]},{"url":"https://bugzilla.suse.com/1275678","tags":["report"]},{"url":"https://bugzilla.suse.com/1275683","tags":["report"]},{"url":"https://bugzilla.suse.com/1275689","tags":["report"]},{"url":"https://bugzilla.suse.com/1275692","tags":["report"]},{"url":"https://bugzilla.suse.com/1275810","tags":["report"]},{"url":"https://bugzilla.suse.com/1275811","tags":["report"]},{"url":"https://bugzilla.suse.com/1275813","tags":["report"]},{"url":"https://bugzilla.suse.com/1275939","tags":["report"]},{"url":"https://bugzilla.suse.com/1275944","tags":["report"]},{"url":"https://bugzilla.suse.com/1275947","tags":["report"]},{"url":"https://bugzilla.suse.com/1275951","tags":["report"]},{"url":"https://bugzilla.suse.com/1275957","tags":["report"]},{"url":"https://bugzilla.suse.com/1275958","tags":["report"]},{"url":"https://bugzilla.suse.com/1275959","tags":["report"]},{"url":"https://bugzilla.suse.com/1276271","tags":["report"]},{"url":"https://bugzilla.suse.com/1276280","tags":["report"]},{"url":"https://bugzilla.suse.com/1276321","tags":["report"]},{"url":"https://bugzilla.suse.com/1276343","tags":["report"]},{"url":"https://bugzilla.suse.com/1276363","tags":["report"]},{"url":"https://bugzilla.suse.com/1276382","tags":["report"]},{"url":"https://bugzilla.suse.com/1276384","tags":["report"]},{"url":"https://bugzilla.suse.com/1276387","tags":["report"]},{"url":"https://bugzilla.suse.com/1276393","tags":["report"]},{"url":"https://bugzilla.suse.com/1276444","tags":["report"]},{"url":"https://bugzilla.suse.com/1276450","tags":["report"]},{"url":"https://bugzilla.suse.com/1276451","tags":["report"]},{"url":"https://bugzilla.suse.com/1276453","tags":["report"]},{"url":"https://bugzilla.suse.com/1276454","tags":["report"]},{"url":"https://bugzilla.suse.com/1276457","tags":["report"]},{"url":"https://bugzilla.suse.com/1276476","tags":["report"]},{"url":"https://bugzilla.suse.com/1276479","tags":["report"]},{"url":"https://bugzilla.suse.com/1276482","tags":["report"]},{"url":"https://bugzilla.suse.com/1276483","tags":["report"]},{"url":"https://bugzilla.suse.com/1276495","tags":["report"]},{"url":"https://bugzilla.suse.com/1276499","tags":["report"]},{"url":"https://bugzilla.suse.com/1276502","tags":["report"]},{"url":"https://bugzilla.suse.com/1276517","tags":["report"]},{"url":"https://bugzilla.suse.com/1276522","tags":["report"]},{"url":"https://bugzilla.suse.com/1276574","tags":["report"]},{"url":"https://bugzilla.suse.com/1276576","tags":["report"]},{"url":"https://bugzilla.suse.com/1276585","tags":["report"]},{"url":"https://bugzilla.suse.com/1276592","tags":["report"]},{"url":"https://bugzilla.suse.com/1276765","tags":["report"]},{"url":"https://bugzilla.suse.com/1276769","tags":["report"]},{"url":"https://bugzilla.suse.com/1276770","tags":["report"]},{"url":"https://bugzilla.suse.com/1276772","tags":["report"]},{"url":"https://bugzilla.suse.com/1276773","tags":["report"]},{"url":"https://bugzilla.suse.com/1276776","tags":["report"]},{"url":"https://bugzilla.suse.com/1276778","tags":["report"]},{"url":"https://bugzilla.suse.com/1276779","tags":["report"]},{"url":"https://bugzilla.suse.com/1276798","tags":["report"]},{"url":"https://bugzilla.suse.com/1276844","tags":["report"]},{"url":"https://bugzilla.suse.com/1276925","tags":["report"]},{"url":"https://bugzilla.suse.com/1276933","tags":["report"]},{"url":"https://bugzilla.suse.com/1276934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276935","tags":["report"]},{"url":"https://bugzilla.suse.com/1276940","tags":["report"]},{"url":"https://bugzilla.suse.com/1276949","tags":["report"]},{"url":"https://bugzilla.suse.com/1276956","tags":["report"]},{"url":"https://bugzilla.suse.com/1277044","tags":["report"]},{"url":"https://bugzilla.suse.com/1277046","tags":["report"]},{"url":"https://bugzilla.suse.com/1277053","tags":["report"]},{"url":"https://bugzilla.suse.com/1277067","tags":["report"]},{"url":"https://bugzilla.suse.com/1277069","tags":["report"]},{"url":"https://bugzilla.suse.com/1277071","tags":["report"]},{"url":"https://bugzilla.suse.com/1277072","tags":["report"]},{"url":"https://bugzilla.suse.com/1277075","tags":["report"]},{"url":"https://bugzilla.suse.com/1277080","tags":["report"]},{"url":"https://bugzilla.suse.com/1277082","tags":["report"]},{"url":"https://bugzilla.suse.com/1277089","tags":["report"]},{"url":"https://bugzilla.suse.com/1277091","tags":["report"]},{"url":"https://bugzilla.suse.com/1277094","tags":["report"]},{"url":"https://bugzilla.suse.com/1277103","tags":["report"]},{"url":"https://bugzilla.suse.com/1277113","tags":["report"]},{"url":"https://bugzilla.suse.com/1277121","tags":["report"]},{"url":"https://bugzilla.suse.com/1277133","tags":["report"]},{"url":"https://bugzilla.suse.com/1277158","tags":["report"]},{"url":"https://bugzilla.suse.com/1277161","tags":["report"]},{"url":"https://bugzilla.suse.com/1277163","tags":["report"]},{"url":"https://bugzilla.suse.com/1277166","tags":["report"]},{"url":"https://bugzilla.suse.com/1277167","tags":["report"]},{"url":"https://bugzilla.suse.com/1277169","tags":["report"]},{"url":"https://bugzilla.suse.com/1277170","tags":["report"]},{"url":"https://bugzilla.suse.com/1277171","tags":["report"]},{"url":"https://bugzilla.suse.com/1277173","tags":["report"]},{"url":"https://bugzilla.suse.com/1277176","tags":["report"]},{"url":"https://bugzilla.suse.com/1277177","tags":["report"]},{"url":"https://bugzilla.suse.com/1277184","tags":["report"]},{"url":"https://bugzilla.suse.com/1277190","tags":["report"]},{"url":"https://bugzilla.suse.com/1277191","tags":["report"]},{"url":"https://bugzilla.suse.com/1277192","tags":["report"]},{"url":"https://bugzilla.suse.com/1277193","tags":["report"]},{"url":"https://bugzilla.suse.com/1277194","tags":["report"]},{"url":"https://bugzilla.suse.com/1277195","tags":["report"]},{"url":"https://bugzilla.suse.com/1277196","tags":["report"]},{"url":"https://bugzilla.suse.com/1277197","tags":["report"]},{"url":"https://bugzilla.suse.com/1277201","tags":["report"]},{"url":"https://bugzilla.suse.com/1277211","tags":["report"]},{"url":"https://bugzilla.suse.com/1277214","tags":["report"]},{"url":"https://bugzilla.suse.com/1277221","tags":["report"]},{"url":"https://bugzilla.suse.com/1277222","tags":["report"]},{"url":"https://bugzilla.suse.com/1277225","tags":["report"]},{"url":"https://bugzilla.suse.com/1277240","tags":["report"]},{"url":"https://bugzilla.suse.com/1277254","tags":["report"]},{"url":"https://bugzilla.suse.com/1277264","tags":["report"]},{"url":"https://bugzilla.suse.com/1277280","tags":["report"]},{"url":"https://bugzilla.suse.com/1277282","tags":["report"]},{"url":"https://bugzilla.suse.com/1277307","tags":["report"]},{"url":"https://bugzilla.suse.com/1277312","tags":["report"]},{"url":"https://bugzilla.suse.com/1277317","tags":["report"]},{"url":"https://bugzilla.suse.com/1277319","tags":["report"]},{"url":"https://bugzilla.suse.com/1277323","tags":["report"]},{"url":"https://bugzilla.suse.com/1277325","tags":["report"]},{"url":"https://bugzilla.suse.com/1277329","tags":["report"]},{"url":"https://bugzilla.suse.com/1277330","tags":["report"]},{"url":"https://bugzilla.suse.com/1277336","tags":["report"]},{"url":"https://bugzilla.suse.com/1277337","tags":["report"]},{"url":"https://bugzilla.suse.com/1277338","tags":["report"]},{"url":"https://bugzilla.suse.com/1277339","tags":["report"]},{"url":"https://bugzilla.suse.com/1277343","tags":["report"]},{"url":"https://bugzilla.suse.com/1277344","tags":["report"]},{"url":"https://bugzilla.suse.com/1277345","tags":["report"]},{"url":"https://bugzilla.suse.com/1277355","tags":["report"]},{"url":"https://bugzilla.suse.com/1277356","tags":["report"]},{"url":"https://bugzilla.suse.com/1277357","tags":["report"]},{"url":"https://bugzilla.suse.com/1277362","tags":["report"]},{"url":"https://bugzilla.suse.com/1277364","tags":["report"]},{"url":"https://bugzilla.suse.com/1277365","tags":["report"]},{"url":"https://bugzilla.suse.com/1277383","tags":["report"]},{"url":"https://bugzilla.suse.com/1277387","tags":["report"]},{"url":"https://bugzilla.suse.com/1277389","tags":["report"]},{"url":"https://bugzilla.suse.com/1277456","tags":["report"]},{"url":"https://bugzilla.suse.com/1277457","tags":["report"]},{"url":"https://bugzilla.suse.com/1277461","tags":["report"]},{"url":"https://bugzilla.suse.com/1277467","tags":["report"]},{"url":"https://bugzilla.suse.com/1277472","tags":["report"]},{"url":"https://bugzilla.suse.com/1277487","tags":["report"]},{"url":"https://bugzilla.suse.com/1277488","tags":["report"]},{"url":"https://bugzilla.suse.com/1277497","tags":["report"]},{"url":"https://bugzilla.suse.com/1277520","tags":["report"]},{"url":"https://bugzilla.suse.com/1277522","tags":["report"]},{"url":"https://bugzilla.suse.com/1277529","tags":["report"]},{"url":"https://bugzilla.suse.com/1277530","tags":["report"]},{"url":"https://bugzilla.suse.com/1277533","tags":["report"]},{"url":"https://bugzilla.suse.com/1277538","tags":["report"]},{"url":"https://bugzilla.suse.com/1277540","tags":["report"]},{"url":"https://bugzilla.suse.com/1277541","tags":["report"]},{"url":"https://bugzilla.suse.com/1277542","tags":["report"]},{"url":"https://bugzilla.suse.com/1277543","tags":["report"]},{"url":"https://bugzilla.suse.com/1277546","tags":["report"]},{"url":"https://bugzilla.suse.com/1277554","tags":["report"]},{"url":"https://bugzilla.suse.com/1277560","tags":["report"]},{"url":"https://bugzilla.suse.com/1277566","tags":["report"]},{"url":"https://bugzilla.suse.com/1277576","tags":["report"]},{"url":"https://bugzilla.suse.com/1277578","tags":["report"]},{"url":"https://bugzilla.suse.com/1277593","tags":["report"]},{"url":"https://bugzilla.suse.com/1277599","tags":["report"]},{"url":"https://bugzilla.suse.com/1277607","tags":["report"]},{"url":"https://bugzilla.suse.com/1277609","tags":["report"]},{"url":"https://bugzilla.suse.com/1277610","tags":["report"]},{"url":"https://bugzilla.suse.com/1277612","tags":["report"]},{"url":"https://bugzilla.suse.com/1277621","tags":["report"]},{"url":"https://bugzilla.suse.com/1277623","tags":["report"]},{"url":"https://bugzilla.suse.com/1277637","tags":["report"]},{"url":"https://bugzilla.suse.com/1277645","tags":["report"]},{"url":"https://bugzilla.suse.com/1277657","tags":["report"]},{"url":"https://bugzilla.suse.com/1277663","tags":["report"]},{"url":"https://bugzilla.suse.com/1277665","tags":["report"]},{"url":"https://bugzilla.suse.com/1277677","tags":["report"]},{"url":"https://bugzilla.suse.com/1277682","tags":["report"]},{"url":"https://bugzilla.suse.com/1277690","tags":["report"]},{"url":"https://bugzilla.suse.com/1277730","tags":["report"]},{"url":"https://bugzilla.suse.com/1277741","tags":["report"]},{"url":"https://bugzilla.suse.com/1277744","tags":["report"]},{"url":"https://bugzilla.suse.com/1277746","tags":["report"]},{"url":"https://bugzilla.suse.com/1277754","tags":["report"]},{"url":"https://bugzilla.suse.com/1277770","tags":["report"]},{"url":"https://bugzilla.suse.com/1277771","tags":["report"]},{"url":"https://bugzilla.suse.com/1277772","tags":["report"]},{"url":"https://bugzilla.suse.com/1277835","tags":["report"]},{"url":"https://bugzilla.suse.com/1277836","tags":["report"]},{"url":"https://bugzilla.suse.com/1277839","tags":["report"]},{"url":"https://bugzilla.suse.com/1277875","tags":["report"]},{"url":"https://bugzilla.suse.com/1277877","tags":["report"]},{"url":"https://bugzilla.suse.com/1277879","tags":["report"]},{"url":"https://bugzilla.suse.com/1277880","tags":["report"]},{"url":"https://bugzilla.suse.com/1277881","tags":["report"]},{"url":"https://bugzilla.suse.com/1277882","tags":["report"]},{"url":"https://bugzilla.suse.com/1277884","tags":["report"]},{"url":"https://bugzilla.suse.com/1277890","tags":["report"]},{"url":"https://bugzilla.suse.com/1277893","tags":["report"]},{"url":"https://bugzilla.suse.com/1277903","tags":["report"]},{"url":"https://bugzilla.suse.com/1277934","tags":["report"]},{"url":"https://bugzilla.suse.com/1278028","tags":["report"]},{"url":"https://bugzilla.suse.com/1278030","tags":["report"]},{"url":"https://bugzilla.suse.com/1278033","tags":["report"]},{"url":"https://bugzilla.suse.com/1278041","tags":["report"]},{"url":"https://bugzilla.suse.com/1278050","tags":["report"]},{"url":"https://bugzilla.suse.com/1278057","tags":["report"]},{"url":"https://bugzilla.suse.com/1278101","tags":["report"]},{"url":"https://bugzilla.suse.com/1278123","tags":["report"]},{"url":"https://bugzilla.suse.com/1278132","tags":["report"]},{"url":"https://bugzilla.suse.com/1278139","tags":["report"]},{"url":"https://bugzilla.suse.com/1278153","tags":["report"]},{"url":"https://bugzilla.suse.com/1278160","tags":["report"]},{"url":"https://bugzilla.suse.com/1278181","tags":["report"]},{"url":"https://bugzilla.suse.com/1278194","tags":["report"]},{"url":"https://bugzilla.suse.com/1278200","tags":["report"]},{"url":"https://bugzilla.suse.com/1278201","tags":["report"]},{"url":"https://bugzilla.suse.com/1278202","tags":["report"]},{"url":"https://bugzilla.suse.com/1278207","tags":["report"]},{"url":"https://bugzilla.suse.com/1278212","tags":["report"]},{"url":"https://bugzilla.suse.com/1278214","tags":["report"]},{"url":"https://bugzilla.suse.com/1278222","tags":["report"]},{"url":"https://bugzilla.suse.com/1278241","tags":["report"]},{"url":"https://bugzilla.suse.com/1278246","tags":["report"]},{"url":"https://bugzilla.suse.com/1278296","tags":["report"]},{"url":"https://bugzilla.suse.com/1278310","tags":["report"]},{"url":"https://bugzilla.suse.com/1278313","tags":["report"]},{"url":"https://bugzilla.suse.com/1278317","tags":["report"]},{"url":"https://bugzilla.suse.com/1278319","tags":["report"]},{"url":"https://bugzilla.suse.com/1278320","tags":["report"]},{"url":"https://bugzilla.suse.com/1278323","tags":["report"]},{"url":"https://bugzilla.suse.com/1278325","tags":["report"]},{"url":"https://bugzilla.suse.com/1278326","tags":["report"]},{"url":"https://bugzilla.suse.com/1278334","tags":["report"]},{"url":"https://bugzilla.suse.com/1278337","tags":["report"]},{"url":"https://bugzilla.suse.com/1278343","tags":["report"]},{"url":"https://bugzilla.suse.com/1278377","tags":["report"]},{"url":"https://bugzilla.suse.com/1278393","tags":["report"]},{"url":"https://bugzilla.suse.com/1278400","tags":["report"]},{"url":"https://bugzilla.suse.com/1278412","tags":["report"]},{"url":"https://bugzilla.suse.com/1278415","tags":["report"]},{"url":"https://bugzilla.suse.com/1278429","tags":["report"]},{"url":"https://bugzilla.suse.com/1278430","tags":["report"]},{"url":"https://bugzilla.suse.com/1278431","tags":["report"]},{"url":"https://bugzilla.suse.com/1278704","tags":["report"]},{"url":"https://bugzilla.suse.com/1278711","tags":["report"]},{"url":"https://bugzilla.suse.com/1279455","tags":["report"]},{"url":"https://bugzilla.suse.com/1279464","tags":["report"]},{"url":"https://bugzilla.suse.com/1279467","tags":["report"]},{"url":"https://bugzilla.suse.com/1279468","tags":["report"]},{"url":"https://bugzilla.suse.com/1279471","tags":["report"]},{"url":"https://bugzilla.suse.com/1279477","tags":["report"]},{"url":"https://bugzilla.suse.com/1279483","tags":["report"]},{"url":"https://bugzilla.suse.com/1279485","tags":["report"]},{"url":"https://bugzilla.suse.com/1279493","tags":["report"]},{"url":"https://bugzilla.suse.com/1279494","tags":["report"]},{"url":"https://bugzilla.suse.com/1279496","tags":["report"]},{"url":"https://bugzilla.suse.com/1279499","tags":["report"]},{"url":"https://bugzilla.suse.com/1279504","tags":["report"]},{"url":"https://bugzilla.suse.com/1279508","tags":["report"]},{"url":"https://bugzilla.suse.com/1279510","tags":["report"]},{"url":"https://bugzilla.suse.com/1279520","tags":["report"]},{"url":"https://bugzilla.suse.com/1279533","tags":["report"]},{"url":"https://bugzilla.suse.com/1279564","tags":["report"]},{"url":"https://bugzilla.suse.com/1279592","tags":["report"]},{"url":"https://bugzilla.suse.com/1279594","tags":["report"]},{"url":"https://bugzilla.suse.com/1279605","tags":["report"]},{"url":"https://bugzilla.suse.com/1279606","tags":["report"]},{"url":"https://bugzilla.suse.com/1279607","tags":["report"]},{"url":"https://bugzilla.suse.com/1279608","tags":["report"]},{"url":"https://bugzilla.suse.com/1279614","tags":["report"]},{"url":"https://bugzilla.suse.com/1279616","tags":["report"]},{"url":"https://bugzilla.suse.com/1279624","tags":["report"]},{"url":"https://bugzilla.suse.com/1279625","tags":["report"]},{"url":"https://bugzilla.suse.com/1279627","tags":["report"]},{"url":"https://bugzilla.suse.com/1279632","tags":["report"]},{"url":"https://bugzilla.suse.com/1279698","tags":["report"]},{"url":"https://bugzilla.suse.com/1279699","tags":["report"]},{"url":"https://bugzilla.suse.com/1279777","tags":["report"]},{"url":"https://bugzilla.suse.com/1279795","tags":["report"]},{"url":"https://bugzilla.suse.com/1279798","tags":["report"]},{"url":"https://bugzilla.suse.com/1279802","tags":["report"]},{"url":"https://bugzilla.suse.com/1279805","tags":["report"]},{"url":"https://bugzilla.suse.com/1279808","tags":["report"]},{"url":"https://bugzilla.suse.com/1279809","tags":["report"]},{"url":"https://bugzilla.suse.com/1279812","tags":["report"]},{"url":"https://bugzilla.suse.com/1279814","tags":["report"]},{"url":"https://bugzilla.suse.com/1279815","tags":["report"]},{"url":"https://bugzilla.suse.com/1279816","tags":["report"]},{"url":"https://bugzilla.suse.com/1279825","tags":["report"]},{"url":"https://bugzilla.suse.com/1279920","tags":["report"]},{"url":"https://bugzilla.suse.com/1279921","tags":["report"]},{"url":"https://bugzilla.suse.com/1279971","tags":["report"]},{"url":"https://bugzilla.suse.com/1280141","tags":["report"]},{"url":"https://bugzilla.suse.com/1280142","tags":["report"]},{"url":"https://bugzilla.suse.com/1280156","tags":["report"]},{"url":"https://bugzilla.suse.com/1280157","tags":["report"]},{"url":"https://bugzilla.suse.com/1280158","tags":["report"]},{"url":"https://bugzilla.suse.com/1280162","tags":["report"]},{"url":"https://bugzilla.suse.com/1280172","tags":["report"]},{"url":"https://bugzilla.suse.com/1280178","tags":["report"]},{"url":"https://bugzilla.suse.com/1280185","tags":["report"]},{"url":"https://bugzilla.suse.com/1280215","tags":["report"]},{"url":"https://bugzilla.suse.com/1280221","tags":["report"]},{"url":"https://bugzilla.suse.com/1280230","tags":["report"]},{"url":"https://bugzilla.suse.com/1280234","tags":["report"]},{"url":"https://bugzilla.suse.com/1280244","tags":["report"]},{"url":"https://bugzilla.suse.com/1280246","tags":["report"]},{"url":"https://bugzilla.suse.com/1280247","tags":["report"]},{"url":"https://bugzilla.suse.com/1280251","tags":["report"]},{"url":"https://bugzilla.suse.com/1280253","tags":["report"]},{"url":"https://bugzilla.suse.com/1280266","tags":["report"]},{"url":"https://bugzilla.suse.com/1280273","tags":["report"]},{"url":"https://bugzilla.suse.com/1280276","tags":["report"]},{"url":"https://bugzilla.suse.com/1280301","tags":["report"]},{"url":"https://bugzilla.suse.com/1280305","tags":["report"]},{"url":"https://bugzilla.suse.com/1280306","tags":["report"]},{"url":"https://bugzilla.suse.com/1280311","tags":["report"]},{"url":"https://bugzilla.suse.com/1280315","tags":["report"]},{"url":"https://bugzilla.suse.com/1280316","tags":["report"]},{"url":"https://bugzilla.suse.com/1280319","tags":["report"]},{"url":"https://bugzilla.suse.com/1280345","tags":["report"]},{"url":"https://bugzilla.suse.com/1280378","tags":["report"]},{"url":"https://bugzilla.suse.com/1280395","tags":["report"]},{"url":"https://bugzilla.suse.com/1280397","tags":["report"]},{"url":"https://bugzilla.suse.com/1280398","tags":["report"]},{"url":"https://bugzilla.suse.com/1280399","tags":["report"]},{"url":"https://bugzilla.suse.com/1280400","tags":["report"]},{"url":"https://bugzilla.suse.com/1280402","tags":["report"]},{"url":"https://bugzilla.suse.com/1280408","tags":["report"]},{"url":"https://bugzilla.suse.com/1280410","tags":["report"]},{"url":"https://bugzilla.suse.com/1280415","tags":["report"]},{"url":"https://bugzilla.suse.com/1280416","tags":["report"]},{"url":"https://bugzilla.suse.com/1280421","tags":["report"]},{"url":"https://bugzilla.suse.com/1280423","tags":["report"]},{"url":"https://bugzilla.suse.com/1280425","tags":["report"]},{"url":"https://bugzilla.suse.com/1280428","tags":["report"]},{"url":"https://bugzilla.suse.com/1280429","tags":["report"]},{"url":"https://bugzilla.suse.com/1280431","tags":["report"]},{"url":"https://bugzilla.suse.com/1280434","tags":["report"]},{"url":"https://bugzilla.suse.com/1280463","tags":["report"]},{"url":"https://bugzilla.suse.com/1280472","tags":["report"]},{"url":"https://bugzilla.suse.com/1280476","tags":["report"]},{"url":"https://bugzilla.suse.com/1280477","tags":["report"]},{"url":"https://bugzilla.suse.com/1280479","tags":["report"]},{"url":"https://bugzilla.suse.com/1280480","tags":["report"]},{"url":"https://bugzilla.suse.com/1280492","tags":["report"]},{"url":"https://bugzilla.suse.com/1280500","tags":["report"]},{"url":"https://bugzilla.suse.com/1280501","tags":["report"]},{"url":"https://bugzilla.suse.com/1280504","tags":["report"]},{"url":"https://bugzilla.suse.com/1280505","tags":["report"]},{"url":"https://bugzilla.suse.com/1280520","tags":["report"]},{"url":"https://bugzilla.suse.com/1280539","tags":["report"]},{"url":"https://bugzilla.suse.com/1280545","tags":["report"]},{"url":"https://bugzilla.suse.com/1280554","tags":["report"]},{"url":"https://bugzilla.suse.com/1280559","tags":["report"]},{"url":"https://bugzilla.suse.com/1280560","tags":["report"]},{"url":"https://bugzilla.suse.com/1280563","tags":["report"]},{"url":"https://bugzilla.suse.com/1280569","tags":["report"]},{"url":"https://bugzilla.suse.com/1280570","tags":["report"]},{"url":"https://bugzilla.suse.com/1280571","tags":["report"]},{"url":"https://bugzilla.suse.com/1280573","tags":["report"]},{"url":"https://bugzilla.suse.com/1280581","tags":["report"]},{"url":"https://bugzilla.suse.com/1280713","tags":["report"]},{"url":"https://bugzilla.suse.com/1280735","tags":["report"]},{"url":"https://bugzilla.suse.com/1280736","tags":["report"]},{"url":"https://bugzilla.suse.com/1280745","tags":["report"]},{"url":"https://bugzilla.suse.com/1280777","tags":["report"]},{"url":"https://bugzilla.suse.com/1280785","tags":["report"]},{"url":"https://bugzilla.suse.com/1280794","tags":["report"]},{"url":"https://bugzilla.suse.com/1280804","tags":["report"]},{"url":"https://bugzilla.suse.com/1280806","tags":["report"]},{"url":"https://bugzilla.suse.com/1280813","tags":["report"]},{"url":"https://bugzilla.suse.com/1280822","tags":["report"]},{"url":"https://bugzilla.suse.com/1280826","tags":["report"]},{"url":"https://bugzilla.suse.com/1280834","tags":["report"]},{"url":"https://bugzilla.suse.com/1280918","tags":["report"]},{"url":"https://bugzilla.suse.com/1280948","tags":["report"]},{"url":"https://bugzilla.suse.com/1280960","tags":["report"]},{"url":"https://bugzilla.suse.com/1280970","tags":["report"]},{"url":"https://bugzilla.suse.com/1280976","tags":["report"]},{"url":"https://bugzilla.suse.com/1280977","tags":["report"]},{"url":"https://bugzilla.suse.com/1280978","tags":["report"]},{"url":"https://bugzilla.suse.com/1280980","tags":["report"]},{"url":"https://bugzilla.suse.com/1280981","tags":["report"]},{"url":"https://bugzilla.suse.com/1280984","tags":["report"]},{"url":"https://bugzilla.suse.com/1280987","tags":["report"]},{"url":"https://bugzilla.suse.com/1280992","tags":["report"]},{"url":"https://bugzilla.suse.com/1280996","tags":["report"]},{"url":"https://bugzilla.suse.com/1281001","tags":["report"]},{"url":"https://bugzilla.suse.com/1281003","tags":["report"]},{"url":"https://bugzilla.suse.com/1281005","tags":["report"]},{"url":"https://bugzilla.suse.com/1281008","tags":["report"]},{"url":"https://bugzilla.suse.com/1281011","tags":["report"]},{"url":"https://bugzilla.suse.com/1281018","tags":["report"]},{"url":"https://bugzilla.suse.com/1281022","tags":["report"]},{"url":"https://bugzilla.suse.com/1281027","tags":["report"]},{"url":"https://bugzilla.suse.com/1281029","tags":["report"]},{"url":"https://bugzilla.suse.com/1281030","tags":["report"]},{"url":"https://bugzilla.suse.com/1281034","tags":["report"]},{"url":"https://bugzilla.suse.com/1281052","tags":["report"]},{"url":"https://bugzilla.suse.com/1281056","tags":["report"]},{"url":"https://bugzilla.suse.com/1281058","tags":["report"]},{"url":"https://bugzilla.suse.com/1281065","tags":["report"]},{"url":"https://bugzilla.suse.com/1281130","tags":["report"]},{"url":"https://bugzilla.suse.com/1281138","tags":["report"]},{"url":"https://bugzilla.suse.com/1281149","tags":["report"]},{"url":"https://bugzilla.suse.com/1281150","tags":["report"]},{"url":"https://bugzilla.suse.com/1281151","tags":["report"]},{"url":"https://bugzilla.suse.com/1281155","tags":["report"]},{"url":"https://bugzilla.suse.com/1281156","tags":["report"]},{"url":"https://bugzilla.suse.com/1281163","tags":["report"]},{"url":"https://bugzilla.suse.com/1281164","tags":["report"]},{"url":"https://bugzilla.suse.com/1281165","tags":["report"]},{"url":"https://bugzilla.suse.com/1281173","tags":["report"]},{"url":"https://bugzilla.suse.com/1281174","tags":["report"]},{"url":"https://bugzilla.suse.com/1281179","tags":["report"]},{"url":"https://bugzilla.suse.com/1281180","tags":["report"]},{"url":"https://bugzilla.suse.com/1281181","tags":["report"]},{"url":"https://bugzilla.suse.com/1281183","tags":["report"]},{"url":"https://bugzilla.suse.com/1281184","tags":["report"]},{"url":"https://bugzilla.suse.com/1281185","tags":["report"]},{"url":"https://bugzilla.suse.com/1281189","tags":["report"]},{"url":"https://bugzilla.suse.com/1281190","tags":["report"]},{"url":"https://bugzilla.suse.com/1281191","tags":["report"]},{"url":"https://bugzilla.suse.com/1281194","tags":["report"]},{"url":"https://bugzilla.suse.com/1281204","tags":["report"]},{"url":"https://bugzilla.suse.com/1281206","tags":["report"]},{"url":"https://bugzilla.suse.com/1281211","tags":["report"]},{"url":"https://bugzilla.suse.com/1281214","tags":["report"]},{"url":"https://bugzilla.suse.com/1281216","tags":["report"]},{"url":"https://bugzilla.suse.com/1281221","tags":["report"]},{"url":"https://bugzilla.suse.com/1281222","tags":["report"]},{"url":"https://bugzilla.suse.com/1281251","tags":["report"]},{"url":"https://bugzilla.suse.com/1281253","tags":["report"]},{"url":"https://bugzilla.suse.com/1281254","tags":["report"]},{"url":"https://bugzilla.suse.com/1281257","tags":["report"]},{"url":"https://bugzilla.suse.com/1281260","tags":["report"]},{"url":"https://bugzilla.suse.com/1281265","tags":["report"]},{"url":"https://bugzilla.suse.com/1281269","tags":["report"]},{"url":"https://bugzilla.suse.com/1281270","tags":["report"]},{"url":"https://bugzilla.suse.com/1281271","tags":["report"]},{"url":"https://bugzilla.suse.com/1281272","tags":["report"]},{"url":"https://bugzilla.suse.com/1281275","tags":["report"]},{"url":"https://bugzilla.suse.com/1281277","tags":["report"]},{"url":"https://bugzilla.suse.com/1281281","tags":["report"]},{"url":"https://bugzilla.suse.com/1281292","tags":["report"]},{"url":"https://bugzilla.suse.com/1281299","tags":["report"]},{"url":"https://bugzilla.suse.com/1281300","tags":["report"]},{"url":"https://bugzilla.suse.com/1281311","tags":["report"]},{"url":"https://bugzilla.suse.com/1281315","tags":["report"]},{"url":"https://bugzilla.suse.com/1281320","tags":["report"]},{"url":"https://bugzilla.suse.com/1281332","tags":["report"]},{"url":"https://bugzilla.suse.com/1281333","tags":["report"]},{"url":"https://bugzilla.suse.com/1281334","tags":["report"]},{"url":"https://bugzilla.suse.com/1281337","tags":["report"]},{"url":"https://bugzilla.suse.com/1281346","tags":["report"]},{"url":"https://bugzilla.suse.com/1281352","tags":["report"]},{"url":"https://bugzilla.suse.com/1281353","tags":["report"]},{"url":"https://bugzilla.suse.com/1281357","tags":["report"]},{"url":"https://bugzilla.suse.com/1281360","tags":["report"]},{"url":"https://bugzilla.suse.com/1281361","tags":["report"]},{"url":"https://bugzilla.suse.com/1281363","tags":["report"]},{"url":"https://bugzilla.suse.com/1281368","tags":["report"]},{"url":"https://bugzilla.suse.com/1281382","tags":["report"]},{"url":"https://bugzilla.suse.com/1281384","tags":["report"]},{"url":"https://bugzilla.suse.com/1281391","tags":["report"]},{"url":"https://bugzilla.suse.com/1281392","tags":["report"]},{"url":"https://bugzilla.suse.com/1281394","tags":["report"]},{"url":"https://bugzilla.suse.com/1281395","tags":["report"]},{"url":"https://bugzilla.suse.com/1281396","tags":["report"]},{"url":"https://bugzilla.suse.com/1281402","tags":["report"]},{"url":"https://bugzilla.suse.com/1281418","tags":["report"]},{"url":"https://bugzilla.suse.com/1281422","tags":["report"]},{"url":"https://bugzilla.suse.com/1281429","tags":["report"]},{"url":"https://bugzilla.suse.com/1281488","tags":["report"]},{"url":"https://bugzilla.suse.com/1281490","tags":["report"]},{"url":"https://bugzilla.suse.com/1281495","tags":["report"]},{"url":"https://bugzilla.suse.com/1281500","tags":["report"]},{"url":"https://bugzilla.suse.com/1281504","tags":["report"]},{"url":"https://bugzilla.suse.com/1281509","tags":["report"]},{"url":"https://bugzilla.suse.com/1281510","tags":["report"]},{"url":"https://bugzilla.suse.com/1281535","tags":["report"]},{"url":"https://bugzilla.suse.com/1281538","tags":["report"]},{"url":"https://bugzilla.suse.com/1281547","tags":["report"]},{"url":"https://bugzilla.suse.com/1281549","tags":["report"]},{"url":"https://bugzilla.suse.com/1281551","tags":["report"]},{"url":"https://bugzilla.suse.com/1281563","tags":["report"]},{"url":"https://bugzilla.suse.com/1281568","tags":["report"]},{"url":"https://bugzilla.suse.com/1281577","tags":["report"]},{"url":"https://bugzilla.suse.com/1281579","tags":["report"]},{"url":"https://bugzilla.suse.com/1281619","tags":["report"]},{"url":"https://bugzilla.suse.com/1281620","tags":["report"]},{"url":"https://bugzilla.suse.com/1281626","tags":["report"]},{"url":"https://bugzilla.suse.com/1281631","tags":["report"]},{"url":"https://bugzilla.suse.com/1281635","tags":["report"]},{"url":"https://bugzilla.suse.com/1281639","tags":["report"]},{"url":"https://bugzilla.suse.com/1281640","tags":["report"]},{"url":"https://bugzilla.suse.com/1281650","tags":["report"]},{"url":"https://bugzilla.suse.com/1281672","tags":["report"]},{"url":"https://bugzilla.suse.com/1281676","tags":["report"]},{"url":"https://bugzilla.suse.com/1281677","tags":["report"]},{"url":"https://bugzilla.suse.com/1281688","tags":["report"]},{"url":"https://bugzilla.suse.com/1281691","tags":["report"]},{"url":"https://bugzilla.suse.com/1281696","tags":["report"]},{"url":"https://bugzilla.suse.com/1281701","tags":["report"]},{"url":"https://bugzilla.suse.com/1281702","tags":["report"]},{"url":"https://bugzilla.suse.com/1281705","tags":["report"]},{"url":"https://bugzilla.suse.com/1281706","tags":["report"]},{"url":"https://bugzilla.suse.com/1281707","tags":["report"]},{"url":"https://bugzilla.suse.com/1281708","tags":["report"]},{"url":"https://bugzilla.suse.com/1281715","tags":["report"]},{"url":"https://bugzilla.suse.com/1281723","tags":["report"]},{"url":"https://bugzilla.suse.com/1281724","tags":["report"]},{"url":"https://bugzilla.suse.com/1281735","tags":["report"]},{"url":"https://bugzilla.suse.com/1281736","tags":["report"]},{"url":"https://bugzilla.suse.com/1281753","tags":["report"]},{"url":"https://bugzilla.suse.com/1281776","tags":["report"]},{"url":"https://bugzilla.suse.com/1281779","tags":["report"]},{"url":"https://bugzilla.suse.com/1281781","tags":["report"]},{"url":"https://bugzilla.suse.com/1281783","tags":["report"]},{"url":"https://bugzilla.suse.com/1281784","tags":["report"]},{"url":"https://bugzilla.suse.com/1281785","tags":["report"]},{"url":"https://bugzilla.suse.com/1281796","tags":["report"]},{"url":"https://bugzilla.suse.com/1281799","tags":["report"]},{"url":"https://bugzilla.suse.com/1281801","tags":["report"]},{"url":"https://bugzilla.suse.com/1281804","tags":["report"]},{"url":"https://bugzilla.suse.com/1281813","tags":["report"]},{"url":"https://bugzilla.suse.com/1281824","tags":["report"]},{"url":"https://bugzilla.suse.com/1281828","tags":["report"]},{"url":"https://bugzilla.suse.com/1281850","tags":["report"]},{"url":"https://bugzilla.suse.com/1281851","tags":["report"]},{"url":"https://bugzilla.suse.com/1281853","tags":["report"]},{"url":"https://bugzilla.suse.com/1281858","tags":["report"]},{"url":"https://bugzilla.suse.com/1281868","tags":["report"]},{"url":"https://bugzilla.suse.com/1281870","tags":["report"]},{"url":"https://bugzilla.suse.com/1281877","tags":["report"]},{"url":"https://bugzilla.suse.com/1281886","tags":["report"]},{"url":"https://bugzilla.suse.com/1281887","tags":["report"]},{"url":"https://bugzilla.suse.com/1281890","tags":["report"]},{"url":"https://bugzilla.suse.com/1281891","tags":["report"]},{"url":"https://bugzilla.suse.com/1281895","tags":["report"]},{"url":"https://bugzilla.suse.com/1281897","tags":["report"]},{"url":"https://bugzilla.suse.com/1281900","tags":["report"]},{"url":"https://bugzilla.suse.com/1281903","tags":["report"]},{"url":"https://bugzilla.suse.com/1281916","tags":["report"]},{"url":"https://bugzilla.suse.com/1281930","tags":["report"]},{"url":"https://bugzilla.suse.com/1281932","tags":["report"]},{"url":"https://bugzilla.suse.com/1281968","tags":["report"]},{"url":"https://bugzilla.suse.com/1281969","tags":["report"]},{"url":"https://bugzilla.suse.com/1281985","tags":["report"]},{"url":"https://bugzilla.suse.com/1281987","tags":["report"]},{"url":"https://bugzilla.suse.com/1281996","tags":["report"]},{"url":"https://bugzilla.suse.com/1282001","tags":["report"]},{"url":"https://bugzilla.suse.com/1282002","tags":["report"]},{"url":"https://bugzilla.suse.com/1282008","tags":["report"]},{"url":"https://bugzilla.suse.com/1282018","tags":["report"]},{"url":"https://bugzilla.suse.com/1282019","tags":["report"]},{"url":"https://bugzilla.suse.com/1282021","tags":["report"]},{"url":"https://bugzilla.suse.com/1282025","tags":["report"]},{"url":"https://bugzilla.suse.com/1282026","tags":["report"]},{"url":"https://bugzilla.suse.com/1282027","tags":["report"]},{"url":"https://bugzilla.suse.com/1282031","tags":["report"]},{"url":"https://bugzilla.suse.com/1282032","tags":["report"]},{"url":"https://bugzilla.suse.com/1282033","tags":["report"]},{"url":"https://bugzilla.suse.com/1282044","tags":["report"]},{"url":"https://bugzilla.suse.com/1282045","tags":["report"]},{"url":"https://bugzilla.suse.com/1282063","tags":["report"]},{"url":"https://bugzilla.suse.com/1282065","tags":["report"]},{"url":"https://bugzilla.suse.com/1282068","tags":["report"]},{"url":"https://bugzilla.suse.com/1282080","tags":["report"]},{"url":"https://bugzilla.suse.com/1282081","tags":["report"]},{"url":"https://bugzilla.suse.com/1282082","tags":["report"]},{"url":"https://bugzilla.suse.com/1282083","tags":["report"]},{"url":"https://bugzilla.suse.com/1282095","tags":["report"]},{"url":"https://bugzilla.suse.com/1282114","tags":["report"]},{"url":"https://bugzilla.suse.com/1282116","tags":["report"]},{"url":"https://bugzilla.suse.com/1282117","tags":["report"]},{"url":"https://bugzilla.suse.com/1282122","tags":["report"]},{"url":"https://bugzilla.suse.com/1282128","tags":["report"]},{"url":"https://bugzilla.suse.com/1282133","tags":["report"]},{"url":"https://bugzilla.suse.com/1282134","tags":["report"]},{"url":"https://bugzilla.suse.com/1282145","tags":["report"]},{"url":"https://bugzilla.suse.com/1282146","tags":["report"]},{"url":"https://bugzilla.suse.com/1282149","tags":["report"]},{"url":"https://bugzilla.suse.com/1282151","tags":["report"]},{"url":"https://bugzilla.suse.com/1282154","tags":["report"]},{"url":"https://bugzilla.suse.com/1282156","tags":["report"]},{"url":"https://bugzilla.suse.com/1282158","tags":["report"]},{"url":"https://bugzilla.suse.com/1282167","tags":["report"]},{"url":"https://bugzilla.suse.com/1282174","tags":["report"]},{"url":"https://bugzilla.suse.com/1282178","tags":["report"]},{"url":"https://bugzilla.suse.com/1282189","tags":["report"]},{"url":"https://bugzilla.suse.com/1282192","tags":["report"]},{"url":"https://bugzilla.suse.com/1282196","tags":["report"]},{"url":"https://bugzilla.suse.com/1282262","tags":["report"]},{"url":"https://bugzilla.suse.com/1282276","tags":["report"]},{"url":"https://bugzilla.suse.com/1282289","tags":["report"]},{"url":"https://bugzilla.suse.com/1282296","tags":["report"]},{"url":"https://bugzilla.suse.com/1282298","tags":["report"]},{"url":"https://bugzilla.suse.com/1282302","tags":["report"]},{"url":"https://bugzilla.suse.com/1282304","tags":["report"]},{"url":"https://bugzilla.suse.com/1282325","tags":["report"]},{"url":"https://bugzilla.suse.com/1282327","tags":["report"]},{"url":"https://bugzilla.suse.com/1282328","tags":["report"]},{"url":"https://bugzilla.suse.com/1282677","tags":["report"]},{"url":"https://bugzilla.suse.com/1282684","tags":["report"]},{"url":"https://bugzilla.suse.com/1282686","tags":["report"]},{"url":"https://bugzilla.suse.com/1282690","tags":["report"]},{"url":"https://bugzilla.suse.com/1282691","tags":["report"]},{"url":"https://bugzilla.suse.com/1282695","tags":["report"]},{"url":"https://bugzilla.suse.com/1282697","tags":["report"]},{"url":"https://bugzilla.suse.com/1282729","tags":["report"]},{"url":"https://bugzilla.suse.com/1282737","tags":["report"]},{"url":"https://bugzilla.suse.com/1282744","tags":["report"]},{"url":"https://bugzilla.suse.com/1282753","tags":["report"]},{"url":"https://bugzilla.suse.com/1282754","tags":["report"]},{"url":"https://bugzilla.suse.com/1282759","tags":["report"]},{"url":"https://bugzilla.suse.com/1282763","tags":["report"]},{"url":"https://bugzilla.suse.com/1282764","tags":["report"]},{"url":"https://bugzilla.suse.com/1282769","tags":["report"]},{"url":"https://bugzilla.suse.com/1282772","tags":["report"]},{"url":"https://bugzilla.suse.com/1282773","tags":["report"]},{"url":"https://bugzilla.suse.com/1282775","tags":["report"]},{"url":"https://bugzilla.suse.com/1282776","tags":["report"]},{"url":"https://bugzilla.suse.com/1282778","tags":["report"]},{"url":"https://bugzilla.suse.com/1282805","tags":["report"]},{"url":"https://bugzilla.suse.com/1282814","tags":["report"]},{"url":"https://bugzilla.suse.com/1282867","tags":["report"]},{"url":"https://bugzilla.suse.com/1282870","tags":["report"]},{"url":"https://bugzilla.suse.com/1282879","tags":["report"]},{"url":"https://bugzilla.suse.com/1282885","tags":["report"]},{"url":"https://bugzilla.suse.com/1282887","tags":["report"]},{"url":"https://bugzilla.suse.com/1282889","tags":["report"]},{"url":"https://bugzilla.suse.com/1282890","tags":["report"]},{"url":"https://bugzilla.suse.com/1282893","tags":["report"]},{"url":"https://bugzilla.suse.com/1282898","tags":["report"]},{"url":"https://bugzilla.suse.com/1282911","tags":["report"]},{"url":"https://bugzilla.suse.com/1282914","tags":["report"]},{"url":"https://bugzilla.suse.com/1282915","tags":["report"]},{"url":"https://bugzilla.suse.com/1282920","tags":["report"]},{"url":"https://bugzilla.suse.com/1282924","tags":["report"]},{"url":"https://bugzilla.suse.com/1282925","tags":["report"]},{"url":"https://bugzilla.suse.com/1282926","tags":["report"]},{"url":"https://bugzilla.suse.com/1282927","tags":["report"]},{"url":"https://bugzilla.suse.com/1282935","tags":["report"]},{"url":"https://bugzilla.suse.com/1282955","tags":["report"]},{"url":"https://bugzilla.suse.com/1282957","tags":["report"]},{"url":"https://bugzilla.suse.com/1282962","tags":["report"]},{"url":"https://bugzilla.suse.com/1282963","tags":["report"]},{"url":"https://bugzilla.suse.com/1282974","tags":["report"]},{"url":"https://bugzilla.suse.com/1282984","tags":["report"]},{"url":"https://bugzilla.suse.com/1283004","tags":["report"]},{"url":"https://bugzilla.suse.com/1283016","tags":["report"]},{"url":"https://bugzilla.suse.com/1283017","tags":["report"]},{"url":"https://bugzilla.suse.com/1283018","tags":["report"]},{"url":"https://bugzilla.suse.com/1283036","tags":["report"]},{"url":"https://bugzilla.suse.com/1283039","tags":["report"]},{"url":"https://bugzilla.suse.com/1283045","tags":["report"]},{"url":"https://bugzilla.suse.com/1283047","tags":["report"]},{"url":"https://bugzilla.suse.com/1283051","tags":["report"]},{"url":"https://bugzilla.suse.com/1283058","tags":["report"]},{"url":"https://bugzilla.suse.com/1283076","tags":["report"]},{"url":"https://bugzilla.suse.com/1283077","tags":["report"]},{"url":"https://bugzilla.suse.com/1283078","tags":["report"]},{"url":"https://bugzilla.suse.com/1283081","tags":["report"]},{"url":"https://bugzilla.suse.com/1283087","tags":["report"]},{"url":"https://bugzilla.suse.com/1283113","tags":["report"]},{"url":"https://bugzilla.suse.com/1283114","tags":["report"]},{"url":"https://bugzilla.suse.com/1283122","tags":["report"]},{"url":"https://bugzilla.suse.com/1283132","tags":["report"]},{"url":"https://bugzilla.suse.com/1283134","tags":["report"]},{"url":"https://bugzilla.suse.com/1283136","tags":["report"]},{"url":"https://bugzilla.suse.com/1283145","tags":["report"]},{"url":"https://bugzilla.suse.com/1283155","tags":["report"]},{"url":"https://bugzilla.suse.com/1283157","tags":["report"]},{"url":"https://bugzilla.suse.com/1283159","tags":["report"]},{"url":"https://bugzilla.suse.com/1283164","tags":["report"]},{"url":"https://bugzilla.suse.com/1283175","tags":["report"]},{"url":"https://bugzilla.suse.com/1283177","tags":["report"]},{"url":"https://bugzilla.suse.com/1283196","tags":["report"]},{"url":"https://bugzilla.suse.com/1283197","tags":["report"]},{"url":"https://bugzilla.suse.com/1283202","tags":["report"]},{"url":"https://bugzilla.suse.com/1283206","tags":["report"]},{"url":"https://bugzilla.suse.com/1283208","tags":["report"]},{"url":"https://bugzilla.suse.com/1283209","tags":["report"]},{"url":"https://bugzilla.suse.com/1283211","tags":["report"]},{"url":"https://bugzilla.suse.com/1283214","tags":["report"]},{"url":"https://bugzilla.suse.com/1283215","tags":["report"]},{"url":"https://bugzilla.suse.com/1283220","tags":["report"]},{"url":"https://bugzilla.suse.com/1283223","tags":["report"]},{"url":"https://bugzilla.suse.com/1283224","tags":["report"]},{"url":"https://bugzilla.suse.com/1283225","tags":["report"]},{"url":"https://bugzilla.suse.com/1283226","tags":["report"]},{"url":"https://bugzilla.suse.com/1283229","tags":["report"]},{"url":"https://bugzilla.suse.com/1283231","tags":["report"]},{"url":"https://bugzilla.suse.com/1283271","tags":["report"]},{"url":"https://bugzilla.suse.com/1283276","tags":["report"]},{"url":"https://bugzilla.suse.com/1283278","tags":["report"]},{"url":"https://bugzilla.suse.com/1283287","tags":["report"]},{"url":"https://bugzilla.suse.com/1283288","tags":["report"]},{"url":"https://bugzilla.suse.com/1283292","tags":["report"]},{"url":"https://bugzilla.suse.com/1283333","tags":["report"]},{"url":"https://bugzilla.suse.com/1283334","tags":["report"]},{"url":"https://bugzilla.suse.com/1283335","tags":["report"]},{"url":"https://bugzilla.suse.com/1283337","tags":["report"]},{"url":"https://bugzilla.suse.com/1283339","tags":["report"]},{"url":"https://bugzilla.suse.com/1283343","tags":["report"]},{"url":"https://bugzilla.suse.com/1283349","tags":["report"]},{"url":"https://bugzilla.suse.com/1283356","tags":["report"]},{"url":"https://bugzilla.suse.com/1283360","tags":["report"]},{"url":"https://bugzilla.suse.com/1283364","tags":["report"]},{"url":"https://bugzilla.suse.com/1283416","tags":["report"]},{"url":"https://bugzilla.suse.com/1283418","tags":["report"]},{"url":"https://bugzilla.suse.com/1283429","tags":["report"]},{"url":"https://bugzilla.suse.com/1283445","tags":["report"]},{"url":"https://bugzilla.suse.com/1283453","tags":["report"]},{"url":"https://bugzilla.suse.com/1283464","tags":["report"]},{"url":"https://bugzilla.suse.com/1283469","tags":["report"]},{"url":"https://bugzilla.suse.com/1283474","tags":["report"]},{"url":"https://bugzilla.suse.com/1283481","tags":["report"]},{"url":"https://bugzilla.suse.com/1283483","tags":["report"]},{"url":"https://bugzilla.suse.com/1283485","tags":["report"]},{"url":"https://bugzilla.suse.com/1283486","tags":["report"]},{"url":"https://bugzilla.suse.com/1283502","tags":["report"]},{"url":"https://bugzilla.suse.com/1283511","tags":["report"]},{"url":"https://bugzilla.suse.com/1283585","tags":["report"]},{"url":"https://bugzilla.suse.com/1283662","tags":["report"]},{"url":"https://bugzilla.suse.com/1283668","tags":["report"]},{"url":"https://bugzilla.suse.com/1283741","tags":["report"]},{"url":"https://bugzilla.suse.com/1283746","tags":["report"]},{"url":"https://bugzilla.suse.com/1283752","tags":["report"]},{"url":"https://bugzilla.suse.com/1283754","tags":["report"]},{"url":"https://bugzilla.suse.com/1283782","tags":["report"]},{"url":"https://bugzilla.suse.com/1283793","tags":["report"]},{"url":"https://bugzilla.suse.com/1283810","tags":["report"]},{"url":"https://bugzilla.suse.com/1283812","tags":["report"]},{"url":"https://bugzilla.suse.com/1283821","tags":["report"]},{"url":"https://bugzilla.suse.com/1283830","tags":["report"]},{"url":"https://bugzilla.suse.com/1283833","tags":["report"]},{"url":"https://bugzilla.suse.com/1283834","tags":["report"]},{"url":"https://bugzilla.suse.com/1283837","tags":["report"]},{"url":"https://bugzilla.suse.com/1283838","tags":["report"]},{"url":"https://bugzilla.suse.com/1283842","tags":["report"]},{"url":"https://bugzilla.suse.com/1283844","tags":["report"]},{"url":"https://bugzilla.suse.com/1283845","tags":["report"]},{"url":"https://bugzilla.suse.com/1283846","tags":["report"]},{"url":"https://bugzilla.suse.com/1283850","tags":["report"]},{"url":"https://bugzilla.suse.com/1283853","tags":["report"]},{"url":"https://bugzilla.suse.com/1283855","tags":["report"]},{"url":"https://bugzilla.suse.com/1283856","tags":["report"]},{"url":"https://bugzilla.suse.com/1283858","tags":["report"]},{"url":"https://bugzilla.suse.com/1283859","tags":["report"]},{"url":"https://bugzilla.suse.com/1283862","tags":["report"]},{"url":"https://bugzilla.suse.com/1283863","tags":["report"]},{"url":"https://bugzilla.suse.com/1283869","tags":["report"]},{"url":"https://bugzilla.suse.com/1283871","tags":["report"]},{"url":"https://bugzilla.suse.com/1283873","tags":["report"]},{"url":"https://bugzilla.suse.com/1283877","tags":["report"]},{"url":"https://bugzilla.suse.com/1283878","tags":["report"]},{"url":"https://bugzilla.suse.com/1283884","tags":["report"]},{"url":"https://bugzilla.suse.com/1283886","tags":["report"]},{"url":"https://bugzilla.suse.com/1283903","tags":["report"]},{"url":"https://bugzilla.suse.com/1283916","tags":["report"]},{"url":"https://bugzilla.suse.com/1283920","tags":["report"]},{"url":"https://bugzilla.suse.com/1283921","tags":["report"]},{"url":"https://bugzilla.suse.com/1283928","tags":["report"]},{"url":"https://bugzilla.suse.com/1283933","tags":["report"]},{"url":"https://bugzilla.suse.com/1283941","tags":["report"]},{"url":"https://bugzilla.suse.com/1283958","tags":["report"]},{"url":"https://bugzilla.suse.com/1283960","tags":["report"]},{"url":"https://bugzilla.suse.com/1283967","tags":["report"]},{"url":"https://bugzilla.suse.com/1284024","tags":["report"]},{"url":"https://bugzilla.suse.com/1284031","tags":["report"]},{"url":"https://bugzilla.suse.com/1284064","tags":["report"]},{"url":"https://bugzilla.suse.com/1284150","tags":["report"]},{"url":"https://bugzilla.suse.com/1284243","tags":["report"]},{"url":"https://bugzilla.suse.com/1284292","tags":["report"]},{"url":"https://bugzilla.suse.com/1284293","tags":["report"]},{"url":"https://bugzilla.suse.com/1284296","tags":["report"]},{"url":"https://bugzilla.suse.com/1284298","tags":["report"]},{"url":"https://bugzilla.suse.com/1284302","tags":["report"]},{"url":"https://bugzilla.suse.com/1284304","tags":["report"]},{"url":"https://bugzilla.suse.com/1284305","tags":["report"]},{"url":"https://bugzilla.suse.com/1284310","tags":["report"]},{"url":"https://bugzilla.suse.com/1284312","tags":["report"]},{"url":"https://bugzilla.suse.com/1284313","tags":["report"]},{"url":"https://bugzilla.suse.com/1284346","tags":["report"]},{"url":"https://bugzilla.suse.com/1284349","tags":["report"]},{"url":"https://bugzilla.suse.com/1284350","tags":["report"]},{"url":"https://bugzilla.suse.com/1284358","tags":["report"]},{"url":"https://bugzilla.suse.com/1284360","tags":["report"]},{"url":"https://bugzilla.suse.com/1284363","tags":["report"]},{"url":"https://bugzilla.suse.com/1284419","tags":["report"]},{"url":"https://bugzilla.suse.com/1284422","tags":["report"]},{"url":"https://bugzilla.suse.com/1284446","tags":["report"]},{"url":"https://bugzilla.suse.com/1284455","tags":["report"]},{"url":"https://bugzilla.suse.com/1284477","tags":["report"]},{"url":"https://bugzilla.suse.com/1284483","tags":["report"]},{"url":"https://bugzilla.suse.com/1284484","tags":["report"]},{"url":"https://bugzilla.suse.com/1284485","tags":["report"]},{"url":"https://bugzilla.suse.com/1284498","tags":["report"]},{"url":"https://bugzilla.suse.com/1284503","tags":["report"]},{"url":"https://bugzilla.suse.com/1284504","tags":["report"]},{"url":"https://bugzilla.suse.com/1284505","tags":["report"]},{"url":"https://bugzilla.suse.com/1284509","tags":["report"]},{"url":"https://bugzilla.suse.com/1284512","tags":["report"]},{"url":"https://bugzilla.suse.com/1284513","tags":["report"]},{"url":"https://bugzilla.suse.com/1284514","tags":["report"]},{"url":"https://bugzilla.suse.com/1284515","tags":["report"]},{"url":"https://bugzilla.suse.com/1284517","tags":["report"]},{"url":"https://bugzilla.suse.com/1284537","tags":["report"]},{"url":"https://bugzilla.suse.com/1284540","tags":["report"]},{"url":"https://bugzilla.suse.com/1284541","tags":["report"]},{"url":"https://bugzilla.suse.com/1284542","tags":["report"]},{"url":"https://bugzilla.suse.com/1284543","tags":["report"]},{"url":"https://bugzilla.suse.com/1284544","tags":["report"]},{"url":"https://bugzilla.suse.com/1284545","tags":["report"]},{"url":"https://bugzilla.suse.com/1284553","tags":["report"]},{"url":"https://bugzilla.suse.com/1284554","tags":["report"]},{"url":"https://bugzilla.suse.com/1284555","tags":["report"]},{"url":"https://bugzilla.suse.com/1284557","tags":["report"]},{"url":"https://bugzilla.suse.com/1284563","tags":["report"]},{"url":"https://bugzilla.suse.com/1284568","tags":["report"]},{"url":"https://bugzilla.suse.com/1284577","tags":["report"]},{"url":"https://bugzilla.suse.com/1284578","tags":["report"]},{"url":"https://bugzilla.suse.com/1284579","tags":["report"]},{"url":"https://bugzilla.suse.com/1284584","tags":["report"]},{"url":"https://bugzilla.suse.com/1284595","tags":["report"]},{"url":"https://bugzilla.suse.com/1284601","tags":["report"]},{"url":"https://bugzilla.suse.com/1284602","tags":["report"]},{"url":"https://bugzilla.suse.com/1284605","tags":["report"]},{"url":"https://bugzilla.suse.com/1284609","tags":["report"]},{"url":"https://bugzilla.suse.com/1284615","tags":["report"]},{"url":"https://bugzilla.suse.com/1284616","tags":["report"]},{"url":"https://bugzilla.suse.com/1284620","tags":["report"]},{"url":"https://bugzilla.suse.com/1284621","tags":["report"]},{"url":"https://bugzilla.suse.com/1284623","tags":["report"]},{"url":"https://bugzilla.suse.com/1284626","tags":["report"]},{"url":"https://bugzilla.suse.com/1284630","tags":["report"]},{"url":"https://bugzilla.suse.com/1284631","tags":["report"]},{"url":"https://bugzilla.suse.com/1284635","tags":["report"]},{"url":"https://bugzilla.suse.com/1284636","tags":["report"]},{"url":"https://bugzilla.suse.com/1284637","tags":["report"]},{"url":"https://bugzilla.suse.com/1284638","tags":["report"]},{"url":"https://bugzilla.suse.com/1284640","tags":["report"]},{"url":"https://bugzilla.suse.com/1284641","tags":["report"]},{"url":"https://bugzilla.suse.com/1284643","tags":["report"]},{"url":"https://bugzilla.suse.com/1284644","tags":["report"]},{"url":"https://bugzilla.suse.com/1284652","tags":["report"]},{"url":"https://bugzilla.suse.com/1284704","tags":["report"]},{"url":"https://bugzilla.suse.com/1284706","tags":["report"]},{"url":"https://bugzilla.suse.com/1284707","tags":["report"]},{"url":"https://bugzilla.suse.com/1284709","tags":["report"]},{"url":"https://bugzilla.suse.com/1284721","tags":["report"]},{"url":"https://bugzilla.suse.com/1284723","tags":["report"]},{"url":"https://bugzilla.suse.com/1284740","tags":["report"]},{"url":"https://bugzilla.suse.com/1285553","tags":["report"]},{"url":"https://bugzilla.suse.com/1285556","tags":["report"]},{"url":"https://bugzilla.suse.com/1285560","tags":["report"]},{"url":"https://bugzilla.suse.com/1285561","tags":["report"]},{"url":"https://bugzilla.suse.com/1285562","tags":["report"]},{"url":"https://bugzilla.suse.com/1285564","tags":["report"]},{"url":"https://bugzilla.suse.com/1285569","tags":["report"]},{"url":"https://bugzilla.suse.com/1285587","tags":["report"]},{"url":"https://bugzilla.suse.com/1285624","tags":["report"]},{"url":"https://bugzilla.suse.com/1285648","tags":["report"]},{"url":"https://bugzilla.suse.com/1285668","tags":["report"]},{"url":"https://bugzilla.suse.com/1285685","tags":["report"]},{"url":"https://bugzilla.suse.com/1285914","tags":["report"]},{"url":"https://bugzilla.suse.com/1285957","tags":["report"]},{"url":"https://bugzilla.suse.com/1285971","tags":["report"]},{"url":"https://bugzilla.suse.com/1285976","tags":["report"]},{"url":"https://bugzilla.suse.com/1285978","tags":["report"]},{"url":"https://bugzilla.suse.com/1285979","tags":["report"]},{"url":"https://bugzilla.suse.com/1285985","tags":["report"]},{"url":"https://bugzilla.suse.com/1285988","tags":["report"]},{"url":"https://bugzilla.suse.com/1285998","tags":["report"]},{"url":"https://bugzilla.suse.com/1286009","tags":["report"]},{"url":"https://bugzilla.suse.com/1286012","tags":["report"]},{"url":"https://bugzilla.suse.com/1286013","tags":["report"]},{"url":"https://bugzilla.suse.com/1286019","tags":["report"]},{"url":"https://bugzilla.suse.com/1286036","tags":["report"]},{"url":"https://bugzilla.suse.com/1286037","tags":["report"]},{"url":"https://bugzilla.suse.com/1286112","tags":["report"]},{"url":"https://bugzilla.suse.com/1286114","tags":["report"]},{"url":"https://bugzilla.suse.com/1286119","tags":["report"]},{"url":"https://bugzilla.suse.com/1286121","tags":["report"]},{"url":"https://bugzilla.suse.com/1286123","tags":["report"]},{"url":"https://bugzilla.suse.com/1286158","tags":["report"]},{"url":"https://bugzilla.suse.com/1286160","tags":["report"]},{"url":"https://bugzilla.suse.com/1286161","tags":["report"]},{"url":"https://bugzilla.suse.com/1286171","tags":["report"]},{"url":"https://bugzilla.suse.com/1286190","tags":["report"]},{"url":"https://bugzilla.suse.com/1286204","tags":["report"]},{"url":"https://bugzilla.suse.com/1286205","tags":["report"]},{"url":"https://bugzilla.suse.com/1286207","tags":["report"]},{"url":"https://bugzilla.suse.com/1286215","tags":["report"]},{"url":"https://bugzilla.suse.com/1286217","tags":["report"]},{"url":"https://bugzilla.suse.com/1286224","tags":["report"]},{"url":"https://bugzilla.suse.com/1286233","tags":["report"]},{"url":"https://bugzilla.suse.com/1286234","tags":["report"]},{"url":"https://bugzilla.suse.com/1286237","tags":["report"]},{"url":"https://bugzilla.suse.com/1286240","tags":["report"]},{"url":"https://bugzilla.suse.com/1286257","tags":["report"]},{"url":"https://bugzilla.suse.com/1286259","tags":["report"]},{"url":"https://bugzilla.suse.com/1286267","tags":["report"]},{"url":"https://bugzilla.suse.com/1286342","tags":["report"]},{"url":"https://bugzilla.suse.com/1286346","tags":["report"]},{"url":"https://bugzilla.suse.com/1286390","tags":["report"]},{"url":"https://bugzilla.suse.com/1286391","tags":["report"]},{"url":"https://bugzilla.suse.com/1286394","tags":["report"]},{"url":"https://bugzilla.suse.com/1286417","tags":["report"]},{"url":"https://bugzilla.suse.com/1286421","tags":["report"]},{"url":"https://bugzilla.suse.com/1286431","tags":["report"]},{"url":"https://bugzilla.suse.com/1286432","tags":["report"]},{"url":"https://bugzilla.suse.com/1286443","tags":["report"]},{"url":"https://bugzilla.suse.com/1286444","tags":["report"]},{"url":"https://bugzilla.suse.com/1286453","tags":["report"]},{"url":"https://bugzilla.suse.com/1286455","tags":["report"]},{"url":"https://bugzilla.suse.com/1286457","tags":["report"]},{"url":"https://bugzilla.suse.com/1286469","tags":["report"]},{"url":"https://bugzilla.suse.com/1286514","tags":["report"]},{"url":"https://bugzilla.suse.com/1286529","tags":["report"]},{"url":"https://bugzilla.suse.com/1286625","tags":["report"]},{"url":"https://bugzilla.suse.com/1286654","tags":["report"]},{"url":"https://bugzilla.suse.com/1286669","tags":["report"]},{"url":"https://bugzilla.suse.com/1286671","tags":["report"]},{"url":"https://bugzilla.suse.com/1286672","tags":["report"]},{"url":"https://bugzilla.suse.com/1286689","tags":["report"]},{"url":"https://bugzilla.suse.com/1286692","tags":["report"]},{"url":"https://bugzilla.suse.com/1286704","tags":["report"]},{"url":"https://bugzilla.suse.com/1286707","tags":["report"]},{"url":"https://bugzilla.suse.com/1286713","tags":["report"]},{"url":"https://bugzilla.suse.com/1286720","tags":["report"]},{"url":"https://bugzilla.suse.com/1286735","tags":["report"]},{"url":"https://bugzilla.suse.com/1286741","tags":["report"]},{"url":"https://bugzilla.suse.com/1286742","tags":["report"]},{"url":"https://bugzilla.suse.com/1286756","tags":["report"]},{"url":"https://bugzilla.suse.com/1286757","tags":["report"]},{"url":"https://bugzilla.suse.com/1286772","tags":["report"]},{"url":"https://bugzilla.suse.com/1286775","tags":["report"]},{"url":"https://bugzilla.suse.com/1286778","tags":["report"]},{"url":"https://bugzilla.suse.com/1286782","tags":["report"]},{"url":"https://bugzilla.suse.com/1286785","tags":["report"]},{"url":"https://bugzilla.suse.com/1286787","tags":["report"]},{"url":"https://bugzilla.suse.com/1286819","tags":["report"]},{"url":"https://bugzilla.suse.com/1286820","tags":["report"]},{"url":"https://bugzilla.suse.com/1286821","tags":["report"]},{"url":"https://bugzilla.suse.com/1286822","tags":["report"]},{"url":"https://bugzilla.suse.com/1286823","tags":["report"]},{"url":"https://bugzilla.suse.com/1286824","tags":["report"]},{"url":"https://bugzilla.suse.com/1286841","tags":["report"]},{"url":"https://bugzilla.suse.com/1286843","tags":["report"]},{"url":"https://bugzilla.suse.com/1286850","tags":["report"]},{"url":"https://bugzilla.suse.com/1286856","tags":["report"]},{"url":"https://bugzilla.suse.com/1286857","tags":["report"]},{"url":"https://bugzilla.suse.com/1286859","tags":["report"]},{"url":"https://bugzilla.suse.com/1286860","tags":["report"]},{"url":"https://bugzilla.suse.com/1286862","tags":["report"]},{"url":"https://bugzilla.suse.com/1286863","tags":["report"]},{"url":"https://bugzilla.suse.com/1286864","tags":["report"]},{"url":"https://bugzilla.suse.com/1286865","tags":["report"]},{"url":"https://bugzilla.suse.com/1286867","tags":["report"]},{"url":"https://bugzilla.suse.com/1286872","tags":["report"]},{"url":"https://bugzilla.suse.com/1286874","tags":["report"]},{"url":"https://bugzilla.suse.com/1286877","tags":["report"]},{"url":"https://bugzilla.suse.com/1286890","tags":["report"]},{"url":"https://bugzilla.suse.com/1286913","tags":["report"]},{"url":"https://bugzilla.suse.com/1286918","tags":["report"]},{"url":"https://bugzilla.suse.com/1286919","tags":["report"]},{"url":"https://bugzilla.suse.com/1287173","tags":["report"]},{"url":"https://bugzilla.suse.com/1287191","tags":["report"]},{"url":"https://bugzilla.suse.com/1287256","tags":["report"]},{"url":"https://bugzilla.suse.com/1287268","tags":["report"]},{"url":"https://bugzilla.suse.com/1287342","tags":["report"]},{"url":"https://bugzilla.suse.com/1287346","tags":["report"]},{"url":"https://bugzilla.suse.com/1287347","tags":["report"]},{"url":"https://bugzilla.suse.com/1287351","tags":["report"]},{"url":"https://bugzilla.suse.com/1287364","tags":["report"]},{"url":"https://bugzilla.suse.com/1287592","tags":["report"]},{"url":"https://bugzilla.suse.com/1287594","tags":["report"]},{"url":"https://bugzilla.suse.com/1287597","tags":["report"]},{"url":"https://bugzilla.suse.com/1287648","tags":["report"]},{"url":"https://bugzilla.suse.com/1287649","tags":["report"]},{"url":"https://bugzilla.suse.com/1287655","tags":["report"]},{"url":"https://bugzilla.suse.com/1287658","tags":["report"]},{"url":"https://bugzilla.suse.com/1287674","tags":["report"]},{"url":"https://bugzilla.suse.com/1287680","tags":["report"]},{"url":"https://bugzilla.suse.com/1287682","tags":["report"]},{"url":"https://bugzilla.suse.com/1287714","tags":["report"]},{"url":"https://bugzilla.suse.com/1287719","tags":["report"]},{"url":"https://bugzilla.suse.com/1287720","tags":["report"]},{"url":"https://bugzilla.suse.com/1287737","tags":["report"]},{"url":"https://bugzilla.suse.com/1287749","tags":["report"]},{"url":"https://bugzilla.suse.com/1287757","tags":["report"]},{"url":"https://bugzilla.suse.com/1287765","tags":["report"]},{"url":"https://bugzilla.suse.com/1287773","tags":["report"]},{"url":"https://bugzilla.suse.com/1287774","tags":["report"]},{"url":"https://bugzilla.suse.com/1287966","tags":["report"]},{"url":"https://bugzilla.suse.com/1287984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287985","tags":["report"]},{"url":"https://bugzilla.suse.com/1287995","tags":["report"]},{"url":"https://bugzilla.suse.com/1288001","tags":["report"]},{"url":"https://bugzilla.suse.com/1288002","tags":["report"]},{"url":"https://bugzilla.suse.com/1288005","tags":["report"]},{"url":"https://bugzilla.suse.com/1288007","tags":["report"]},{"url":"https://bugzilla.suse.com/1288014","tags":["report"]},{"url":"https://bugzilla.suse.com/1288061","tags":["report"]},{"url":"https://bugzilla.suse.com/1288088","tags":["report"]},{"url":"https://bugzilla.suse.com/1288125","tags":["report"]},{"url":"https://bugzilla.suse.com/1288127","tags":["report"]},{"url":"https://bugzilla.suse.com/1288246","tags":["report"]},{"url":"https://bugzilla.suse.com/1288248","tags":["report"]},{"url":"https://bugzilla.suse.com/1288521","tags":["report"]},{"url":"https://bugzilla.suse.com/1288522","tags":["report"]},{"url":"https://bugzilla.suse.com/1288527","tags":["report"]},{"url":"https://bugzilla.suse.com/1288584","tags":["report"]},{"url":"https://bugzilla.suse.com/1288592","tags":["report"]},{"url":"https://bugzilla.suse.com/1288627","tags":["report"]},{"url":"https://bugzilla.suse.com/1288629","tags":["report"]},{"url":"https://bugzilla.suse.com/1288668","tags":["report"]},{"url":"https://bugzilla.suse.com/1288694","tags":["report"]},{"url":"https://bugzilla.suse.com/1288752","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99150","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265091-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267882","tags":["report"]},{"url":"https://bugzilla.suse.com/1269182","tags":["report"]},{"url":"https://bugzilla.suse.com/1274257","tags":["report"]},{"url":"https://bugzilla.suse.com/1275521","tags":["report"]},{"url":"https://bugzilla.suse.com/1275955","tags":["report"]},{"url":"https://bugzilla.suse.com/1276245","tags":["report"]},{"url":"https://bugzilla.suse.com/1276275","tags":["report"]},{"url":"https://bugzilla.suse.com/1276440","tags":["report"]},{"url":"https://bugzilla.suse.com/1276443","tags":["report"]},{"url":"https://bugzilla.suse.com/1276774","tags":["report"]},{"url":"https://bugzilla.suse.com/1277079","tags":["report"]},{"url":"https://bugzilla.suse.com/1277084","tags":["report"]},{"url":"https://bugzilla.suse.com/1277130","tags":["report"]},{"url":"https://bugzilla.suse.com/1277135","tags":["report"]},{"url":"https://bugzilla.suse.com/1277142","tags":["report"]},{"url":"https://bugzilla.suse.com/1277157","tags":["report"]},{"url":"https://bugzilla.suse.com/1277168","tags":["report"]},{"url":"https://bugzilla.suse.com/1277182","tags":["report"]},{"url":"https://bugzilla.suse.com/1277200","tags":["report"]},{"url":"https://bugzilla.suse.com/1277333","tags":["report"]},{"url":"https://bugzilla.suse.com/1277451","tags":["report"]},{"url":"https://bugzilla.suse.com/1277675","tags":["report"]},{"url":"https://bugzilla.suse.com/1277732","tags":["report"]},{"url":"https://bugzilla.suse.com/1277785","tags":["report"]},{"url":"https://bugzilla.suse.com/1277819","tags":["report"]},{"url":"https://bugzilla.suse.com/1278074","tags":["report"]},{"url":"https://bugzilla.suse.com/1278081","tags":["report"]},{"url":"https://bugzilla.suse.com/1278117","tags":["report"]},{"url":"https://bugzilla.suse.com/1278172","tags":["report"]},{"url":"https://bugzilla.suse.com/1278198","tags":["report"]},{"url":"https://bugzilla.suse.com/1278213","tags":["report"]},{"url":"https://bugzilla.suse.com/1278217","tags":["report"]},{"url":"https://bugzilla.suse.com/1278350","tags":["report"]},{"url":"https://bugzilla.suse.com/1278379","tags":["report"]},{"url":"https://bugzilla.suse.com/1278405","tags":["report"]},{"url":"https://bugzilla.suse.com/1279420","tags":["report"]},{"url":"https://bugzilla.suse.com/1279460","tags":["report"]},{"url":"https://bugzilla.suse.com/1279700","tags":["report"]},{"url":"https://bugzilla.suse.com/1279823","tags":["report"]},{"url":"https://bugzilla.suse.com/1280312","tags":["report"]},{"url":"https://bugzilla.suse.com/1280330","tags":["report"]},{"url":"https://bugzilla.suse.com/1280331","tags":["report"]},{"url":"https://bugzilla.suse.com/1280332","tags":["report"]},{"url":"https://bugzilla.suse.com/1280346","tags":["report"]},{"url":"https://bugzilla.suse.com/1280988","tags":["report"]},{"url":"https://bugzilla.suse.com/1281006","tags":["report"]},{"url":"https://bugzilla.suse.com/1281080","tags":["report"]},{"url":"https://bugzilla.suse.com/1281145","tags":["report"]},{"url":"https://bugzilla.suse.com/1281256","tags":["report"]},{"url":"https://bugzilla.suse.com/1281274","tags":["report"]},{"url":"https://bugzilla.suse.com/1281342","tags":["report"]},{"url":"https://bugzilla.suse.com/1281528","tags":["report"]},{"url":"https://bugzilla.suse.com/1281532","tags":["report"]},{"url":"https://bugzilla.suse.com/1281536","tags":["report"]},{"url":"https://bugzilla.suse.com/1281552","tags":["report"]},{"url":"https://bugzilla.suse.com/1281555","tags":["report"]},{"url":"https://bugzilla.suse.com/1281588","tags":["report"]},{"url":"https://bugzilla.suse.com/1281883","tags":["report"]},{"url":"https://bugzilla.suse.com/1282165","tags":["report"]},{"url":"https://bugzilla.suse.com/1282169","tags":["report"]},{"url":"https://bugzilla.suse.com/1282735","tags":["report"]},{"url":"https://bugzilla.suse.com/1282741","tags":["report"]},{"url":"https://bugzilla.suse.com/1282886","tags":["report"]},{"url":"https://bugzilla.suse.com/1282958","tags":["report"]},{"url":"https://bugzilla.suse.com/1282971","tags":["report"]},{"url":"https://bugzilla.suse.com/1282993","tags":["report"]},{"url":"https://bugzilla.suse.com/1283038","tags":["report"]},{"url":"https://bugzilla.suse.com/1283173","tags":["report"]},{"url":"https://bugzilla.suse.com/1283228","tags":["report"]},{"url":"https://bugzilla.suse.com/1283233","tags":["report"]},{"url":"https://bugzilla.suse.com/1283504","tags":["report"]},{"url":"https://bugzilla.suse.com/1283508","tags":["report"]},{"url":"https://bugzilla.suse.com/1283513","tags":["report"]},{"url":"https://bugzilla.suse.com/1283737","tags":["report"]},{"url":"https://bugzilla.suse.com/1283780","tags":["report"]},{"url":"https://bugzilla.suse.com/1283781","tags":["report"]},{"url":"https://bugzilla.suse.com/1283785","tags":["report"]},{"url":"https://bugzilla.suse.com/1283887","tags":["report"]},{"url":"https://bugzilla.suse.com/1284303","tags":["report"]},{"url":"https://bugzilla.suse.com/1284306","tags":["report"]},{"url":"https://bugzilla.suse.com/1284561","tags":["report"]},{"url":"https://bugzilla.suse.com/1284600","tags":["report"]},{"url":"https://bugzilla.suse.com/1284632","tags":["report"]},{"url":"https://bugzilla.suse.com/1284642","tags":["report"]},{"url":"https://bugzilla.suse.com/1285594","tags":["report"]},{"url":"https://bugzilla.suse.com/1285645","tags":["report"]},{"url":"https://bugzilla.suse.com/1285647","tags":["report"]},{"url":"https://bugzilla.suse.com/1286001","tags":["report"]},{"url":"https://bugzilla.suse.com/1286133","tags":["report"]},{"url":"https://bugzilla.suse.com/1286186","tags":["report"]},{"url":"https://bugzilla.suse.com/1286208","tags":["report"]},{"url":"https://bugzilla.suse.com/1286458","tags":["report"]},{"url":"https://bugzilla.suse.com/1286665","tags":["report"]},{"url":"https://bugzilla.suse.com/1286667","tags":["report"]},{"url":"https://bugzilla.suse.com/1286670","tags":["report"]},{"url":"https://bugzilla.suse.com/1286673","tags":["report"]},{"url":"https://bugzilla.suse.com/1286674","tags":["report"]},{"url":"https://bugzilla.suse.com/1286694","tags":["report"]},{"url":"https://bugzilla.suse.com/1286708","tags":["report"]},{"url":"https://bugzilla.suse.com/1286744","tags":["report"]},{"url":"https://bugzilla.suse.com/1286826","tags":["report"]},{"url":"https://bugzilla.suse.com/1286870","tags":["report"]},{"url":"https://bugzilla.suse.com/1287647","tags":["report"]},{"url":"https://bugzilla.suse.com/1287981","tags":["report"]},{"url":"https://bugzilla.suse.com/1288126","tags":["report"]},{"url":"https://bugzilla.suse.com/1288226","tags":["report"]},{"url":"https://bugzilla.suse.com/1288406","tags":["report"]},{"url":"https://bugzilla.suse.com/1288513","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-99094","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-50241","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50241","tags":["report"]},{"url":"https://git.kernel.org/linus/63fab04cbd0f96191b6e5beedc3b643b01c15889","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2NO44GTYBSPPWKFDREFWHITK4XKTNVLP/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50263","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T7LN2FDZYBYZRLX5LOA3REDAXV7VKGW4/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26865","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-50241","title":"NFSD: Initialize struct nfsd4_copy earlier","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct nfsd4_copy earlier\n\nEnsure the refcount and async_copies fields are initialized early.\ncleanup_async_copy() will reference these fields if an error occurs\nin nfsd4_copy(). If they are not correctly initialized, at the very\nleast, a refcount underflow occurs.","status":"published","published":"2024-11-09T10:14:51.119Z","modified":"2026-08-05T11:42:42.206Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:21.784174Z"}],"euvd":[{"id":"EUVD-2024-45158","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct nfsd4_copy earlier\n\nEnsure the refcount and async_copies fields are initialized early.\ncleanup_async_copy() will reference these fields if an error occurs\nin nfsd4_copy(). If they are not correctly initialized, at the very\nleast, a refcount underflow occurs.","status":"published","published":"2024-11-09T10:14:51Z","modified":"2026-08-05T11:42:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:15.33989Z"}],"ghsa":[{"id":"GHSA-x9gg-ww2m-r7gj","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct nfsd4_copy earlier\n\nEnsure the refcount and async_copies fields are initialized early.\ncleanup_async_copy() will reference these fields if an error occurs\nin nfsd4_copy(). If they are not correctly initialized, at the very\nleast, a refcount underflow occurs.","status":"published","published":"2024-11-09T12:30:49Z","modified":"2024-12-14T21:31:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:59:11.996128Z"}],"nvd":[{"id":"CVE-2024-50241","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct nfsd4_copy earlier\n\nEnsure the refcount and async_copies fields are initialized early.\ncleanup_async_copy() will reference these fields if an error occurs\nin nfsd4_copy(). If they are not correctly initialized, at the very\nleast, a refcount underflow occurs.","status":"published","published":"2024-11-09T11:15:09.823Z","modified":"2026-08-04T11:21:36.033Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:10:36.560164Z"}],"osv":[{"id":"BELL-CVE-2024-50241","title":"CVE-2024-50241 does not affect BellSoft software","status":"withdrawn","published":"2024-11-12T06:00:09.972318Z","modified":"2026-01-26T09:48:11.789909Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:20.711507Z"},{"id":"CVE-2024-50241","title":"NFSD: Initialize struct nfsd4_copy earlier","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Initialize struct nfsd4_copy earlier\n\nEnsure the refcount and async_copies fields are initialized early.\ncleanup_async_copy() will reference these fields if an error occurs\nin nfsd4_copy(). If they are not correctly initialized, at the very\nleast, a refcount underflow occurs.","status":"published","published":"2024-11-09T10:14:51.119Z","modified":"2026-11-06T17:27:16.56998647Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T18:04:00.766717Z"},{"id":"DEBIAN-CVE-2024-50241","description":"In the Linux kernel, the following vulnerability has been resolved:  NFSD: Initialize struct nfsd4_copy earlier  Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.","status":"published","published":"2024-11-09T11:15:09.823Z","modified":"2026-11-02T12:03:06.188638171Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"OESA-2024-2491","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  xen-netfront: Fix NULL sring after live migration  A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM.  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace:  finish_task_switch+0x71/0x230  timerqueue_del+0x1d/0x40  hrtimer_try_to_cancel+0xb5/0x110  xennet_alloc_rx_buffers+0x2a0/0x2a0  napi_busy_loop+0xdb/0x270  sock_poll+0x87/0x90  do_sys_poll+0x26f/0x580  tracing_map_insert+0x1d4/0x2f0  event_hist_trigger+0x14a/0x260   finish_task_switch+0x71/0x230  __schedule+0x256/0x890  recalc_sigpending+0x1b/0x50  xen_sched_clock+0x15/0x20  __rb_reserve_next+0x12d/0x140  ring_buffer_lock_reserve+0x123/0x3d0  event_triggers_call+0x87/0xb0  trace_event_buffer_commit+0x1c4/0x210  xen_clocksource_get_cycles+0x15/0x20  ktime_get_ts64+0x51/0xf0  SyS_ppoll+0x160/0x1a0  SyS_ppoll+0x160/0x1a0  do_syscall_64+0x73/0x130  entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]---  xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed  There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time(CVE-2022-48969)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbonding: stop the device in bond_setup_by_slave()\r\n\r\nCommit 9eed321cde22 (\u0026quot;net: lapbether: only support ethernet devices\u0026quot;)\nhas been able to keep syzbot away from net/lapb, until today.\r\n\r\nIn the following splat [1], the issue is that a lapbether device has\nbeen created on a bonding device without members. Then adding a non\nARPHRD_ETHER member forced the bonding master to change its type.\r\n\r\nThe fix is to make sure we call dev_close() in bond_setup_by_slave()\nso that the potential linked lapbether devices (or any other devices\nhaving assumptions on the physical device) are removed.\r\n\r\nA similar bug has been addressed in commit 40baec225765\n(\u0026quot;bonding: fix panic on non-ARPHRD_ETHER enslave failure\u0026quot;)\r\n\r\n[1]\nskbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0\nkernel BUG at net/core/skbuff.c:192 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : skb_panic net/core/skbuff.c:188 [inline]\npc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nlr : skb_panic net/core/skbuff.c:188 [inline]\nlr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nsp : ffff800096a06aa0\nx29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000\nx26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea\nx23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140\nx20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100\nx17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001\nx14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00\nx8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c\nx2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086\nCall trace:\nskb_panic net/core/skbuff.c:188 [inline]\nskb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nskb_push+0xf0/0x108 net/core/skbuff.c:2446\nip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384\ndev_hard_header include/linux/netdevice.h:3136 [inline]\nlapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257\nlapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447\nlapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149\nlapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251\n__lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326\nlapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nlapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nbond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332\nbond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539\ndev_ifsioc+0x754/0x9ac\ndev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786\nsock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217\nsock_ioctl+0x4e8/0x834 net/socket.c:1322\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_\n---truncated---(CVE-2023-52784)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: verify mac len before reading mac header\r\n\r\nLLC reads the mac header with eth_hdr without verifying that the skb\nhas an Ethernet header.\r\n\r\nSyzbot was able to enter llc_rcv on a tun device. Tun can insert\npackets without mac len and with user configurable skb-\u0026gt;protocol\n(passing a tun_pi header when not configuring IFF_NO_PI).\r\n\r\n    BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218\n    __netif_receive_skb_one_core net/core/dev.c:5523 [inline]\n    __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637\n    netif_receive_skb_internal net/core/dev.c:5723 [inline]\n    netif_receive_skb+0x58/0x660 net/core/dev.c:5782\n    tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n    tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002\r\n\r\nAdd a mac_len test before all three eth_hdr(skb) calls under net/llc.\r\n\r\nThere are further uses in include/net/llc_pdu.h. All these are\nprotected by a test skb-\u0026gt;protocol == ETH_P_802_2. Which does not\nprotect against this tun scenario.\r\n\r\nBut the mac_len test added in this patch in llc_fixup_skb will\nindirectly protect those too. That is called from llc_rcv before any\nother LLC code.\r\n\r\nIt is tempting to just add a blanket mac_len check in llc_rcv, but\nnot sure whether that could break valid LLC paths that do not assume\nan Ethernet header. 802.2 LLC may be used on top of non-802.3\nprotocols in principle. The below referenced commit shows that used\nto, on top of Token Ring.\r\n\r\nAt least one of the three eth_hdr uses goes back to before the start\nof git history. But the one that syzbot exercises is introduced in\nthis commit. That commit is old enough (2008), that effectively all\nstable kernels should receive this.(CVE-2023-52843)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix UAF in svc_tcp_listen_data_ready()\r\n\r\nAfter the listener svc_sock is freed, and before invoking svc_tcp_accept()\nfor the established child sock, there is a window that the newsock\nretaining a freed listener svc_sock in sk_user_data which cloning from\nparent. In the race window, if data is received on the newsock, we will\nobserve use-after-free report in svc_tcp_listen_data_ready().\r\n\r\nReproduce by two tasks:\r\n\r\n1. while :; do rpc.nfsd 0 ; rpc.nfsd; done\n2. while :; do echo \u0026quot;\u0026quot; | ncat -4 127.0.0.1 2049 ; done\r\n\r\nKASAN report:\r\n\r\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]\n  Read of size 8 at addr ffff888139d96228 by task nc/102553\n  CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18\n  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dump_stack_lvl+0x33/0x50\n   print_address_description.constprop.0+0x27/0x310\n   print_report+0x3e/0x70\n   kasan_report+0xae/0xe0\n   svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]\n   tcp_data_queue+0x9f4/0x20e0\n   tcp_rcv_established+0x666/0x1f60\n   tcp_v4_do_rcv+0x51c/0x850\n   tcp_v4_rcv+0x23fc/0x2e80\n   ip_protocol_deliver_rcu+0x62/0x300\n   ip_local_deliver_finish+0x267/0x350\n   ip_local_deliver+0x18b/0x2d0\n   ip_rcv+0x2fb/0x370\n   __netif_receive_skb_one_core+0x166/0x1b0\n   process_backlog+0x24c/0x5e0\n   __napi_poll+0xa2/0x500\n   net_rx_action+0x854/0xc90\n   __do_softirq+0x1bb/0x5de\n   do_softirq+0xcb/0x100\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   ...\n   \u0026lt;/TASK\u0026gt;\r\n\r\n  Allocated by task 102371:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   __kasan_kmalloc+0x7b/0x90\n   svc_setup_socket+0x52/0x4f0 [sunrpc]\n   svc_addsock+0x20d/0x400 [sunrpc]\n   __write_ports_addfd+0x209/0x390 [nfsd]\n   write_ports+0x239/0x2c0 [nfsd]\n   nfsctl_transaction_write+0xac/0x110 [nfsd]\n   vfs_write+0x1c3/0xae0\n   ksys_write+0xed/0x1c0\n   do_syscall_64+0x38/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\r\n\r\n  Freed by task 102551:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   kasan_save_free_info+0x2a/0x50\n   __kasan_slab_free+0x106/0x190\n   __kmem_cache_free+0x133/0x270\n   svc_xprt_free+0x1e2/0x350 [sunrpc]\n   svc_xprt_destroy_all+0x25a/0x440 [sunrpc]\n   nfsd_put+0x125/0x240 [nfsd]\n   nfsd_svc+0x2cb/0x3c0 [nfsd]\n   write_threads+0x1ac/0x2a0 [nfsd]\n   nfsctl_transaction_write+0xac/0x110 [nfsd]\n   vfs_write+0x1c3/0xae0\n   ksys_write+0xed/0x1c0\n   do_syscall_64+0x38/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\r\n\r\nFix the UAF by simply doing nothing in svc_tcp_listen_data_ready()\nif state != TCP_LISTEN, that will avoid dereferencing svsk for all\nchild socket.(CVE-2023-52885)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/aux: Fix AUX buffer serialization\r\n\r\nOle reported that event-\u0026gt;mmap_mutex is strictly insufficient to\nserialize the AUX buffer, add a per RB mutex to fully serialize it.\r\n\r\nNote that in the lock order comment the perf_event::mmap_mutex order\nwas already wrong, that is, it nesting under mmap_lock is not new with\nthis patch.(CVE-2024-46713)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled  Fix missuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was hold.  This was discovered through the lock debugging, and the corresponding log is as follows:  raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40 ... Call trace:  warn_bogus_irq_restore+0x30/0x40  _raw_spin_unlock_irqrestore+0x84/0xc8  add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2]  hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2]  hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2]  create_qp+0x138/0x258  ib_create_qp_kernel+0x50/0xe8  create_mad_qp+0xa8/0x128  ib_mad_port_open+0x218/0x448  ib_mad_init_device+0x70/0x1f8  add_client_context+0xfc/0x220  enable_device_and_get+0xd0/0x140  ib_register_device.part.0+0xf4/0x1c8  ib_register_device+0x34/0x50  hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2]  hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2]  __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2]  hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2](CVE-2024-47735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mm: call the security_mmap_file() LSM hook in remap_file_pages()  The remap_file_pages syscall handler calls do_mmap() directly, which doesn\u0026apos;t contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux.  So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux.  The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1].  The PoC:  $ cat \u0026gt; test.c  int main(void) {  size_t pagesz = sysconf(_SC_PAGE_SIZE);  int mfd = syscall(SYS_memfd_create, \u0026quot;test\u0026quot;, 0);  const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,   MAP_SHARED, mfd, 0);  unsigned int old = syscall(SYS_personality, 0xffffffff);  syscall(SYS_personality, READ_IMPLIES_EXEC | old);  syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);  syscall(SYS_personality, old);  // show the RWX page exists even if W^X policy is enforced  int fd = open(\u0026quot;/proc/self/maps\u0026quot;, O_RDONLY);  unsigned char buf2[1024];  while (1) {   int ret = read(fd, buf2, 1024);   if (ret \u0026lt;= 0) break;   write(1, buf2, ret);  }  close(fd); }  $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)  [PM: subject line tweaks](CVE-2024-47745)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition  In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to \u0026amp;prev(dev)-\u0026gt;timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:  CPU0                                    CPU1                        |  ether3_ledoff ether3_remove         |   free_netdev(dev);   |   put_devic           |   kfree(dev);         |  |  ether3_outw(priv(dev)-\u0026gt;regs.config2 |= CFG2_CTRLO, REG_CONFIG2);                       | // use dev  Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.(CVE-2024-47747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/cxgb4: Added NULL check for lookup_atid  The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-47749)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Initialize denominators\u0026apos; default to 1  [WHAT \u0026amp; HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0.  This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.(CVE-2024-49899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: avoid NULL pointer dereference  iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn\u0026apos;t either.(CVE-2024-49929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: prevent nf_skb_duplicated corruption  syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].  Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.  [1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316  caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace:  \u0026lt;TASK\u0026gt;   __dump_stack lib/dump_stack.c:93 [inline]   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119   check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49   nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87   nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30   expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]   nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288   nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23   nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]   nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626   nf_hook+0x2c4/0x450 include/linux/netfilter.h:269   NF_HOOK_COND include/linux/netfilter.h:302 [inline]   ip_output+0x185/0x230 net/ipv4/ip_output.c:433   ip_local_out net/ipv4/ip_output.c:129 [inline]   ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495   udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981   udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269   sock_sendmsg_nosec net/socket.c:730 [inline]   __sock_sendmsg+0x1a6/0x270 net/socket.c:745   ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597   ___sys_sendmsg net/socket.c:2651 [inline]   __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737   __do_sys_sendmmsg net/socket.c:2766 [inline]   __se_sys_sendmmsg net/socket.c:2763 [inline]   __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68  \u0026lt;/TASK\u0026gt;(CVE-2024-49952)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: xtables: avoid NFPROTO_UNSPEC where needed  syzbot managed to call xt_cluster match via ebtables:   WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780  [..]  ebt_do_table+0x174b/0x2a40  Module registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing.  As this is only useful to restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only.  Pablo points out that this is a general issue, direct users of the set/getsockopt interface can call into targets/matches that were only intended for use with ip(6)tables.  Check all UNSPEC matches and targets for similar issues:  - matches and targets are fine except if they assume skb_network_header()   is valid -- this is only true when called from inet layer: ip(6) stack   pulls the ip/ipv6 header into linear data area. - targets that return XT_CONTINUE or other xtables verdicts must be   restricted too, they are incompatbile with the ebtables traverser, e.g.   EBT_CONTINUE is a completely different value than XT_CONTINUE.  Most matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by ip(6)tables.  The MARK target is also used by arptables, so register for NFPROTO_ARP too.  While at it, bail out if connbytes fails to enable the corresponding conntrack family.  This change passes the selftests in iptables.git.(CVE-2024-50038)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: br_netfilter: fix panic with metadata_dst skb  Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit.  It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded  When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata-\u0026gt;dst.dev is NULL.  Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there\u0026apos;s a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.  The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst-\u0026gt;dev, thus the crash.  This case was never supported in the first place, so drop the packet instead.  PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [  176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [  176.292101] Mem abort info: [  176.292184]   ESR = 0x0000000096000004 [  176.292322]   EC = 0x25: DABT (current EL), IL = 32 bits [  176.292530]   SET = 0, FnV = 0 [  176.292709]   EA = 0, S1PTW = 0 [  176.292862]   FSC = 0x04: level 0 translation fault [  176.293013] Data abort info: [  176.293104]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [  176.293488]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [  176.293787]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [  176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [  176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [  176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [  176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [  176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [  176.296314] Hardware name: linux,dummy-virt (DT) [  176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [  176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [  176.297636] sp : ffff800080003630 [  176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [  176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [  176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [  176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [  176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [  176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [  176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [  176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [  176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [  176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [  176.300889] Call trace: [  176.301123]  br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.301411]  br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [  176.301703]  nf_hook_slow+0x48/0x124 [  176.302060]  br_forward_finish+0xc8/0xe8 [bridge] [  176.302371]  br_nf_hook_thresh+0x124/0x134 [br_netfilter] [  176.302605]  br_nf_forward_finish+0x118/0x22c [br_netfilter] [  176.302824]  br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [  176.303136]  br_nf_forward+0x2b8/0x4e0 [br_netfilter] [  176.303359]  nf_hook_slow+0x48/0x124 [  176.303 ---truncated---(CVE-2024-50045)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/rtrs-srv: Avoid null pointer deref during path establishment  For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.  So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.(CVE-2024-50062)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  tty: n_gsm: Fix use-after-free in gsm_cleanup_mux  BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace:  \u0026lt;TASK\u0026gt;  gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]  __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]  __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389  update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500  __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846  __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161  gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]  _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107  __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]  ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195  ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79  __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338  __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805  tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818  Allocated by task 65:  gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]  gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]  gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]  gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]  tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391  tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39  flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445  process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229  worker_thread+0x3dc/0x950 kernel/workqueue.c:3391  kthread+0x2a3/0x370 kernel/kthread.c:389  ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257  Freed by task 3367:  kfree+0x126/0x420 mm/slub.c:4580  gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]  gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]  tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818  [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.(CVE-2024-50073)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  unicode: Don\u0026apos;t special case ignorable code points  We don\u0026apos;t need to handle them separately. Instead, just let them decompose/casefold to themselves.(CVE-2024-50089)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  udf: fix uninit-value use in udf_get_fileshortad  Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].  [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000(CVE-2024-50143)\r\n\r\n(CVE-2024-50151)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ceph: remove the incorrect Fw reference check when dirtying pages  When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won\u0026apos;t hold the Fw caps and there is case will it get the Fw reference.(CVE-2024-50179)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  fbdev: sisfb: Fix strbuf array overflow  The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1. The strbuf1 array contains digit characters and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, \u0026quot;%ux%ux8\u0026quot;, xres, yres); more than 16 bytes will be written to strbuf. It is suggested to increase the size of the strbuf array to 24.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50180)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  irqchip/gic-v4: Don\u0026apos;t allow a VMOVP on a dying VPE  Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/.  Plug the race by checking the value of vmapp_count, which tracks whether the VPE is mapped ot not, and returning an error in this case.  This involves making vmapp_count common to both GICv4.1 and its v4.0 ancestor.(CVE-2024-50192)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: propagate directory read errors from nilfs_find_entry()  Syzbot reported that a task hang occurs in vcs_open() during a fuzzing test for nilfs2.  The root cause of this problem is that in nilfs_find_entry(), which searches for directory entries, ignores errors when loading a directory page/folio via nilfs_get_folio() fails.  If the filesystem images is corrupted, and the i_size of the directory inode is large, and the directory page/folio is successfully read but fails the sanity check, for example when it is zero-filled, nilfs_check_folio() may continue to spit out error messages in bursts.  Fix this issue by propagating the error to the callers when loading a page/folio fails in nilfs_find_entry().  The current interface of nilfs_find_entry() and its callers is outdated and cannot propagate error codes such as -EIO and -ENOMEM returned via nilfs_find_entry(), so fix it together.(CVE-2024-50202)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()  The step variable is initialized to zero. It is changed in the loop, but if it\u0026apos;s not changed it will remain zero. Add a variable check before the division.  The observed behavior was introduced by commit 826b5de90c0b (\u0026quot;ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size\u0026quot;), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50205)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix potential deadlock with newly created symlinks  Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among the reader/writer semaphore nilfs-\u0026gt;ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the fs_reclaim pseudo lock.  This is because after commit 21fc61c73c39 (\u0026quot;don\u0026apos;t put symlink bodies in pagecache into highmem\u0026quot;), the gfp flags of the page cache for symbolic links are overwritten to GFP_KERNEL via inode_nohighmem().  This is not a problem for symlinks read from the backing device, because the __GFP_FS flag is dropped after inode_nohighmem() is called.  However, when a new symlink is created with nilfs_symlink(), the gfp flags remain overwritten to GFP_KERNEL.  Then, memory allocation called from page_symlink() etc.  triggers memory reclamation including the FS layer, which may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can cause a deadlock if they are called while nilfs-\u0026gt;ns_segctor_sem is held:  Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs_new_inode() and __nilfs_read_inode() do, as a workaround until we adopt nofs allocation scope consistently or improve the locking constraints.(CVE-2024-50229)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix kernel bug due to missing clearing of checked flag  Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug.  This was found to be because the \u0026quot;checked\u0026quot; flag of a page/folio was not cleared when it was discarded by nilfs2\u0026apos;s own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded.  So, fix that.  This was necessary when the use of nilfs2\u0026apos;s own page discard routine was applied to more than just metadata files.(CVE-2024-50230)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Initialize struct nfsd4_copy earlier  Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.(CVE-2024-50241)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: Additional check in ni_clear()  Checking of NTFS_FLAGS_LOG_REPLAYING added to prevent access to uninitialized bitmap during replay process.(CVE-2024-50244)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ntfs3: Add bounds checking to mi_enum_attr()  Added bounds checking to make sure that every attr don\u0026apos;t stray beyond valid memory region.(CVE-2024-50248)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: Fix out-of-bounds write in trie_get_next_key()  trie_get_next_key() allocates a node stack with size trie-\u0026gt;max_prefixlen, while it writes (trie-\u0026gt;max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.(CVE-2024-50262)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()  Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():  [   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry [   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [   57.331328] Call Trace: [   57.331477]  \u0026lt;TASK\u0026gt; [...] [   57.333511]  ? do_user_addr_fault+0x3e5/0x740 [   57.333778]  ? exc_page_fault+0x70/0x170 [   57.334016]  ? asm_exc_page_fault+0x2b/0x30 [   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0 [   57.335164]  ocfs2_xa_set+0x704/0xcf0 [   57.335381]  ? _raw_spin_unlock+0x1a/0x40 [   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20 [   57.335915]  ? trace_preempt_on+0x1e/0x70 [   57.336153]  ? start_this_handle+0x16c/0x500 [   57.336410]  ? preempt_count_sub+0x50/0x80 [   57.336656]  ? _raw_read_unlock+0x20/0x40 [   57.336906]  ? start_this_handle+0x16c/0x500 [   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0 [   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0 [   57.337706]  ? ocfs2_start_trans+0x13d/0x290 [   57.337971]  ocfs2_xattr_set+0xb13/0xfb0 [   57.338207]  ? dput+0x46/0x1c0 [   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30 [   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30 [   57.338948]  __vfs_removexattr+0x92/0xc0 [   57.339182]  __vfs_removexattr_locked+0xd5/0x190 [   57.339456]  ? preempt_count_sub+0x50/0x80 [   57.339705]  vfs_removexattr+0x5f/0x100 [...]  Reproducer uses faultinject facility to fail ocfs2_xa_remove() -\u0026gt; ocfs2_xa_value_truncate() with -ENOMEM.  In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following \u0026apos;rc\u0026apos; check is wrong and execution flow do \u0026apos;ocfs2_xa_remove_entry(loc);\u0026apos; twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to \u0026apos;out\u0026apos;.  Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy.(CVE-2024-50265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  usb: musb: sunxi: Fix accessing an released usb phy  Commit 6ed05c68cbca (\u0026quot;usb: musb: sunxi: Explicitly release USB PHY on exit\u0026quot;) will cause that usb phy @glue-\u0026gt;xceiv is accessed after released.  1) register platform driver @sunxi_musb_driver // get the usb phy @glue-\u0026gt;xceiv sunxi_musb_probe() -\u0026gt; devm_usb_get_phy().  2) register and unregister platform driver @musb_driver musb_probe() -\u0026gt; sunxi_musb_init() use the phy here //the phy is released here musb_remove() -\u0026gt; sunxi_musb_exit() -\u0026gt; devm_usb_put_phy()  3) register @musb_driver again musb_probe() -\u0026gt; sunxi_musb_init() use the phy here but the phy has been released at 2). ...  Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().(CVE-2024-50269)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: reinitialize delayed ref list after deleting it from the list  At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0026apos;s ref_add_list using list_del(), which leaves the ref\u0026apos;s add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively.  If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref\u0026apos;s add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise.  So fix this by deleting from the list with list_del_init() instead.(CVE-2024-50273)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: av7110: fix a spectre vulnerability  As warned by smatch:  drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue \u0026apos;av7110-\u0026gt;ci_slot\u0026apos; [w] (local cap)  There is a spectre-related vulnerability at the code. Fix it.(CVE-2024-50289)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write  When io_uring starts a write, it\u0026apos;ll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write:  task:fio             state:D stack:0     pid:886   tgid:886   ppid:876 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_rwsem_wait+0x1e8/0x3f8  __percpu_down_read+0xe8/0x500  io_write+0xbb8/0xff8  io_issue_sqe+0x10c/0x1020  io_submit_sqes+0x614/0x2110  __arm64_sys_io_uring_enter+0x524/0x1038  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170 INFO: task fsfreeze:7364 blocked for more than 15 seconds.       Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963  with the attempting freezer stuck trying to grab the rwsem:  task:fsfreeze        state:D stack:0     pid:7364  tgid:7364  ppid:995 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_down_write+0x2b0/0x680  freeze_super+0x248/0x8a8  do_vfs_ioctl+0x149c/0x1b18  __arm64_sys_ioctl+0xd0/0x1a0  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170  Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn\u0026apos;t set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress.  Since freezing requires CAP_SYS_ADMIN in the first place, this isn\u0026apos;t something that can be triggered by a regular user.(CVE-2024-53052)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: s5p-jpeg: prevent buffer overflows  The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it.  While here, remove an unused word = 0 assignment.(CVE-2024-53061)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nfs: Fix KMSAN warning in decode_getfattr_attrs()  Fix the following KMSAN warning:  CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_generic+0x806/0xb00  nfs4_xdr_dec_getattr+0x1de/0x240  rpcauth_unwrap_resp_decode+0xab/0x100  rpcauth_unwrap_resp+0x95/0xc0  call_decode+0x4ff/0xb50  __rpc_execute+0x57b/0x19d0  rpc_execute+0x368/0x5e0  rpc_run_task+0xcfe/0xee0  nfs4_proc_getattr+0x5b5/0x990  __nfs_revalidate_inode+0x477/0xd00  nfs_access_get_cached+0x1021/0x1cc0  nfs_do_access+0x9f/0xae0  nfs_permission+0x1e4/0x8c0  inode_permission+0x356/0x6c0  link_path_walk+0x958/0x1330  path_lookupat+0xce/0x6b0  filename_lookup+0x23e/0x770  vfs_statx+0xe7/0x970  vfs_fstatat+0x1f2/0x2c0  __se_sys_newfstatat+0x67/0x880  __x64_sys_newfstatat+0xbd/0x120  x64_sys_call+0x1826/0x3cf0  do_syscall_64+0xd0/0x1b0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr-\u0026gt;mdsthreshold is not initialized.  Fix the issue by initializing fattr-\u0026gt;mdsthreshold to NULL in nfs_fattr_init().(CVE-2024-53066)","status":"published","published":"2024-11-29T11:07:58Z","modified":"2026-08-18T01:18:41.573018562Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2492","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: support non-r10 register spill/fill to/from stack in precision tracking  Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset.  To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don\u0026apos;t touch idx field for maximum performance, as it\u0026apos;s checked most frequently during backtracking.  This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches.  There are only three differences in selftests\u0026apos; BPF object files according to veristat, all in the positive direction (less states).  File                                    Program        Insns (A)  Insns (B)  Insns  (DIFF)  States (A)  States (B)  States (DIFF) --------------------------------------  -------------  ---------  ---------  -------------  ----------  ----------  ------------- test_cls_redirect_dynptr.bpf.linked3.o  cls_redirect        2987       2864  -123 (-4.12%)         240         231    -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o         syncookie_tc       82848      82661  -187 (-0.23%)        5107        5073   -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o         syncookie_xdp      85116      84964  -152 (-0.18%)        5162        5130   -32 (-0.62%)  Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees.  Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry\u0026apos;s insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don\u0026apos;t want to entries, so we need to reuse last added entry, if it is present.  Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that.    [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/(CVE-2023-52920)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: pm: only mark \u0026apos;subflow\u0026apos; endp as available\r\n\r\nAdding the following warning ...\r\n\r\n  WARN_ON_ONCE(msk-\u0026gt;pm.local_addr_used == 0)\r\n\r\n... before decrementing the local_addr_used counter helped to find a bug\nwhen running the \u0026quot;remove single address\u0026quot; subtest from the mptcp_join.sh\nselftests.\r\n\r\nRemoving a \u0026apos;signal\u0026apos; endpoint will trigger the removal of all subflows\nlinked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with\nrm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used\ncounter, which is wrong in this case because this counter is linked to\n\u0026apos;subflow\u0026apos; endpoints, and here it is a \u0026apos;signal\u0026apos; endpoint that is being\nremoved.\r\n\r\nNow, the counter is decremented, only if the ID is being used outside\nof mptcp_pm_nl_rm_addr_or_subflow(), only for \u0026apos;subflow\u0026apos; endpoints, and\nif the ID is not 0 -- local_addr_used is not taking into account these\nones. This marking of the ID as being available, and the decrement is\ndone no matter if a subflow using this ID is currently available,\nbecause the subflow could have been closed before.(CVE-2024-45010)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvideo/aperture: optionally match the device in sysfb_disable()\r\n\r\nIn aperture_remove_conflicting_pci_devices(), we currently only\ncall sysfb_disable() on vga class devices.  This leads to the\nfollowing problem when the pimary device is not VGA compatible:\r\n\r\n1. A PCI device with a non-VGA class is the boot display\n2. That device is probed first and it is not a VGA device so\n   sysfb_disable() is not called, but the device resources\n   are freed by aperture_detach_platform_device()\n3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable()\n4. NULL pointer dereference via sysfb_disable() since the resources\n   have already been freed by aperture_detach_platform_device() when\n   it was called by the other device.\r\n\r\nFix this by passing a device pointer to sysfb_disable() and checking\nthe device to determine if we should execute it or not.\r\n\r\nv2: Fix build when CONFIG_SCREEN_INFO is not set\nv3: Move device check into the mutex\n    Drop primary variable in aperture_remove_conflicting_pci_devices()\n    Drop __init on pci sysfb_pci_dev_is_enabled()(CVE-2024-46698)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/aux: Fix AUX buffer serialization\r\n\r\nOle reported that event-\u0026gt;mmap_mutex is strictly insufficient to\nserialize the AUX buffer, add a per RB mutex to fully serialize it.\r\n\r\nNote that in the lock order comment the perf_event::mmap_mutex order\nwas already wrong, that is, it nesting under mmap_lock is not new with\nthis patch.(CVE-2024-46713)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: protect XDP configuration with a mutex\r\n\r\nThe main threat to data consistency in ice_xdp() is a possible asynchronous\nPF reset. It can be triggered by a user or by TX timeout handler.\r\n\r\nXDP setup and PF reset code access the same resources in the following\nsections:\n* ice_vsi_close() in ice_prepare_for_reset() - already rtnl-locked\n* ice_vsi_rebuild() for the PF VSI - not protected\n* ice_vsi_open() - already rtnl-locked\r\n\r\nWith an unfortunate timing, such accesses can result in a crash such as the\none below:\r\n\r\n[ +1.999878] ice 0000:b1:00.0: Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring 14\n[ +2.002992] ice 0000:b1:00.0: Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring 18\n[Mar15 18:17] ice 0000:b1:00.0 ens801f0np0: NETDEV WATCHDOG: CPU: 38: transmit queue 14 timed out 80692736 ms\n[ +0.000093] ice 0000:b1:00.0 ens801f0np0: tx_timeout: VSI_num: 6, Q 14, NTC: 0x0, HW_HEAD: 0x0, NTU: 0x0, INT: 0x4000001\n[ +0.000012] ice 0000:b1:00.0 ens801f0np0: tx_timeout recovery level 1, txqueue 14\n[ +0.394718] ice 0000:b1:00.0: PTP reset successful\n[ +0.006184] BUG: kernel NULL pointer dereference, address: 0000000000000098\n[ +0.000045] #PF: supervisor read access in kernel mode\n[ +0.000023] #PF: error_code(0x0000) - not-present page\n[ +0.000023] PGD 0 P4D 0\n[ +0.000018] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ +0.000023] CPU: 38 PID: 7540 Comm: kworker/38:1 Not tainted 6.8.0-rc7 #1\n[ +0.000031] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021\n[ +0.000036] Workqueue: ice ice_service_task [ice]\n[ +0.000183] RIP: 0010:ice_clean_tx_ring+0xa/0xd0 [ice]\n[...]\n[ +0.000013] Call Trace:\n[ +0.000016] \u0026lt;TASK\u0026gt;\n[ +0.000014] ? __die+0x1f/0x70\n[ +0.000029] ? page_fault_oops+0x171/0x4f0\n[ +0.000029] ? schedule+0x3b/0xd0\n[ +0.000027] ? exc_page_fault+0x7b/0x180\n[ +0.000022] ? asm_exc_page_fault+0x22/0x30\n[ +0.000031] ? ice_clean_tx_ring+0xa/0xd0 [ice]\n[ +0.000194] ice_free_tx_ring+0xe/0x60 [ice]\n[ +0.000186] ice_destroy_xdp_rings+0x157/0x310 [ice]\n[ +0.000151] ice_vsi_decfg+0x53/0xe0 [ice]\n[ +0.000180] ice_vsi_rebuild+0x239/0x540 [ice]\n[ +0.000186] ice_vsi_rebuild_by_type+0x76/0x180 [ice]\n[ +0.000145] ice_rebuild+0x18c/0x840 [ice]\n[ +0.000145] ? delay_tsc+0x4a/0xc0\n[ +0.000022] ? delay_tsc+0x92/0xc0\n[ +0.000020] ice_do_reset+0x140/0x180 [ice]\n[ +0.000886] ice_service_task+0x404/0x1030 [ice]\n[ +0.000824] process_one_work+0x171/0x340\n[ +0.000685] worker_thread+0x277/0x3a0\n[ +0.000675] ? preempt_count_add+0x6a/0xa0\n[ +0.000677] ? _raw_spin_lock_irqsave+0x23/0x50\n[ +0.000679] ? __pfx_worker_thread+0x10/0x10\n[ +0.000653] kthread+0xf0/0x120\n[ +0.000635] ? __pfx_kthread+0x10/0x10\n[ +0.000616] ret_from_fork+0x2d/0x50\n[ +0.000612] ? __pfx_kthread+0x10/0x10\n[ +0.000604] ret_from_fork_asm+0x1b/0x30\n[ +0.000604] \u0026lt;/TASK\u0026gt;\r\n\r\nThe previous way of handling this through returning -EBUSY is not viable,\nparticularly when destroying AF_XDP socket, because the kernel proceeds\nwith removal anyway.\r\n\r\nThere is plenty of code between those calls and there is no need to create\na large critical section that covers all of them, same as there is no need\nto protect ice_vsi_rebuild() with rtnl_lock().\r\n\r\nAdd xdp_state_lock mutex to protect ice_vsi_rebuild() and ice_xdp().\r\n\r\nLeaving unprotected sections in between would result in two states that\nhave to be considered:\n1. when the VSI is closed, but not yet rebuild\n2. when VSI is already rebuild, but not yet open\r\n\r\nThe latter case is actually already handled through !netif_running() case,\nwe just need to adjust flag checking a little. The former one is not as\ntrivial, because between ice_vsi_close() and ice_vsi_rebuild(), a lot of\nhardware interaction happens, this can make adding/deleting rings exit\nwith an error. Luckily, VSI rebuild is pending and can apply new\nconfiguration for us in a managed fashion.\r\n\r\nTherefore, add an additional VSI state flag ICE_VSI_REBUILD_PENDING to\nindicate that ice_x\n---truncated---(CVE-2024-46765)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  icmp: change the order of rate limits  ICMP messages are ratelimited :  After the blamed commits, the two rate limiters are applied in this order:  1) host wide ratelimit (icmp_global_allow())  2) Per destination ratelimit (inetpeer based)  In order to avoid side-channels attacks, we need to apply the per destination check first.  This patch makes the following change :  1) icmp_global_allow() checks if the host wide limit is reached.    But credits are not yet consumed. This is deferred to 3)  2) The per destination limit is checked/updated.    This might add a new node in inetpeer tree.  3) icmp_global_consume() consumes tokens if prior operations succeeded.  This means that host wide ratelimit is still effective in keeping inetpeer tree small even under DDOS.  As a bonus, I removed icmp_global.lock as the fast path can use a lock-free operation.(CVE-2024-47678)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()  Blamed commit accidentally removed a check for rt-\u0026gt;rt6i_idev being NULL, as spotted by syzbot:  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024  RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]  RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df \u0026lt;80\u0026gt; 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  \u0026lt;TASK\u0026gt;   addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856  addrconf_notify+0x3cb/0x1020   notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93   call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]   call_netdevice_notifiers net/core/dev.c:2046 [inline]   unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352   unregister_netdevice_many net/core/dev.c:11414 [inline]   unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289   unregister_netdevice include/linux/netdevice.h:3129 [inline]   __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685   tun_detach drivers/net/tun.c:701 [inline]   tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510   __fput+0x24a/0x8a0 fs/file_table.c:422   task_work_run+0x24f/0x310 kernel/task_work.c:228   exit_task_work include/linux/task_work.h:40 [inline]   do_exit+0xa2f/0x27f0 kernel/exit.c:882   do_group_exit+0x207/0x2c0 kernel/exit.c:1031   __do_sys_exit_group kernel/exit.c:1042 [inline]   __se_sys_exit_group kernel/exit.c:1040 [inline]   __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040   x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0  \u0026lt;/TASK\u0026gt; Modules linked in: ---[ end trace 0000000000000000 ]---  RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]  RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df \u0026lt;80\u0026gt; 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 R ---truncated---(CVE-2024-47707)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param  In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues.  This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.  To address this, the TSF value is now stored in a local variable `ies_tsf` before the RCU lock is released. The `param-\u0026gt;tsf_lo` field is then assigned using this local variable, ensuring that the TSF value is safely accessed.(CVE-2024-47712)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mm: call the security_mmap_file() LSM hook in remap_file_pages()  The remap_file_pages syscall handler calls do_mmap() directly, which doesn\u0026apos;t contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux.  So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux.  The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1].  The PoC:  $ cat \u0026gt; test.c  int main(void) {  size_t pagesz = sysconf(_SC_PAGE_SIZE);  int mfd = syscall(SYS_memfd_create, \u0026quot;test\u0026quot;, 0);  const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,   MAP_SHARED, mfd, 0);  unsigned int old = syscall(SYS_personality, 0xffffffff);  syscall(SYS_personality, READ_IMPLIES_EXEC | old);  syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);  syscall(SYS_personality, old);  // show the RWX page exists even if W^X policy is enforced  int fd = open(\u0026quot;/proc/self/maps\u0026quot;, O_RDONLY);  unsigned char buf2[1024];  while (1) {   int ret = read(fd, buf2, 1024);   if (ret \u0026lt;= 0) break;   write(1, buf2, ret);  }  close(fd); }  $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)  [PM: subject line tweaks](CVE-2024-47745)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition  In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to \u0026amp;prev(dev)-\u0026gt;timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:  CPU0                                    CPU1                        |  ether3_ledoff ether3_remove         |   free_netdev(dev);   |   put_devic           |   kfree(dev);         |  |  ether3_outw(priv(dev)-\u0026gt;regs.config2 |= CFG2_CTRLO, REG_CONFIG2);                       | // use dev  Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.(CVE-2024-47747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/cxgb4: Added NULL check for lookup_atid  The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-47749)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  x86/sgx: Fix deadlock in SGX NUMA node search  When the current node doesn\u0026apos;t have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.  Also worth mentioning is that it\u0026apos;s perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.  Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.(CVE-2024-49856)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mm, slub: avoid zeroing kmalloc redzone  Since commit 946fa0dbf2d8 (\u0026quot;mm/slub: extend redzone check to extra allocated kmalloc space than requested\u0026quot;), setting orig_size treats the wasted space (object_size - orig_size) as a redzone. However with init_on_free=1 we clear the full object-\u0026gt;size, including the redzone.  Additionally we clear the object metadata, including the stored orig_size, making it zero, which makes check_object() treat the whole object as a redzone.  These issues lead to the following BUG report with \u0026quot;slub_debug=FUZ init_on_free=1\u0026quot;:  [    0.000000] ============================================================================= [    0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten [    0.000000] ----------------------------------------------------------------------------- [    0.000000] [    0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc [    0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc [    0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff) [    0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8 [    0.000000] [    0.000000] Redzone  ffff000010032850: cc cc cc cc cc cc cc cc                          ........ [    0.000000] Object   ffff000010032858: cc cc cc cc cc cc cc cc                          ........ [    0.000000] Redzone  ffff000010032860: cc cc cc cc cc cc cc cc                          ........ [    0.000000] Padding  ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00              ............ [    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144 [    0.000000] Hardware name: NXP i.MX95 19X19 board (DT) [    0.000000] Call trace: [    0.000000]  dump_backtrace+0x90/0xe8 [    0.000000]  show_stack+0x18/0x24 [    0.000000]  dump_stack_lvl+0x74/0x8c [    0.000000]  dump_stack+0x18/0x24 [    0.000000]  print_trailer+0x150/0x218 [    0.000000]  check_object+0xe4/0x454 [    0.000000]  free_to_partial_list+0x2f8/0x5ec  To address the issue, use orig_size to clear the used area. And restore the value of orig_size after clear the remaining area.  When CONFIG_SLUB_DEBUG not defined, (get_orig_size()\u0026apos; directly returns s-\u0026gt;object_size. So when using memset to init the area, the size can simply be orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not enabled. And orig_size can never be bigger than object_size.(CVE-2024-49885)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Initialize denominators\u0026apos; default to 1  [WHAT \u0026amp; HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0.  This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.(CVE-2024-49899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Add null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipe  This commit addresses a null pointer dereference issue in the `dcn20_program_pipe` function. The issue could occur when `pipe_ctx-\u0026gt;plane_state` is null.  The fix adds a check to ensure `pipe_ctx-\u0026gt;plane_state` is not null before accessing. This prevents a null pointer dereference.  Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed \u0026apos;pipe_ctx-\u0026gt;plane_state\u0026apos; could be null (see line 1877)(CVE-2024-49914)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw  This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc-\u0026gt;clk_mgr` is null.  The fix adds a check to ensure `dc-\u0026gt;clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference.  Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed \u0026apos;dc-\u0026gt;clk_mgr\u0026apos; could be null (see line 782)(CVE-2024-49915)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: Fix an unsafe loop on the list  The kernel may crash when deleting a genetlink family if there are still listeners for that family:  Oops: Kernel access of bad area, sig: 11 [#1]   ...   NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0   LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0   Call Trace: __netlink_clear_multicast_users+0x74/0xc0 genl_unregister_family+0xd4/0x2d0  Change the unsafe loop on the list to a safe one, because inside the loop there is an element removal from this list.(CVE-2024-50024)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/v3d: Stop the active perfmon before being destroyed  When running `kmscube` with one or more performance monitors enabled via `GALLIUM_HUD`, the following kernel panic can occur:  [   55.008324] Unable to handle kernel paging request at virtual address 00000000052004a4 [   55.008368] Mem abort info: [   55.008377]   ESR = 0x0000000096000005 [   55.008387]   EC = 0x25: DABT (current EL), IL = 32 bits [   55.008402]   SET = 0, FnV = 0 [   55.008412]   EA = 0, S1PTW = 0 [   55.008421]   FSC = 0x05: level 1 translation fault [   55.008434] Data abort info: [   55.008442]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [   55.008455]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [   55.008467]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [   55.008481] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001046c6000 [   55.008497] [00000000052004a4] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [   55.008525] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [   55.008542] Modules linked in: rfcomm [...] vc4 v3d snd_soc_hdmi_codec drm_display_helper gpu_sched drm_shmem_helper cec drm_dma_helper drm_kms_helper i2c_brcmstb drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [   55.008799] CPU: 2 PID: 166 Comm: v3d_bin Tainted: G         C         6.6.47+rpt-rpi-v8 #1  Debian 1:6.6.47-1+rpt1 [   55.008824] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [   55.008838] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [   55.008855] pc : __mutex_lock.constprop.0+0x90/0x608 [   55.008879] lr : __mutex_lock.constprop.0+0x58/0x608 [   55.008895] sp : ffffffc080673cf0 [   55.008904] x29: ffffffc080673cf0 x28: 0000000000000000 x27: ffffff8106188a28 [   55.008926] x26: ffffff8101e78040 x25: ffffff8101baa6c0 x24: ffffffd9d989f148 [   55.008947] x23: ffffffda1c2a4008 x22: 0000000000000002 x21: ffffffc080673d38 [   55.008968] x20: ffffff8101238000 x19: ffffff8104f83188 x18: 0000000000000000 [   55.008988] x17: 0000000000000000 x16: ffffffda1bd04d18 x15: 00000055bb08bc90 [   55.009715] x14: 0000000000000000 x13: 0000000000000000 x12: ffffffda1bd4cbb0 [   55.010433] x11: 00000000fa83b2da x10: 0000000000001a40 x9 : ffffffda1bd04d04 [   55.011162] x8 : ffffff8102097b80 x7 : 0000000000000000 x6 : 00000000030a5857 [   55.011880] x5 : 00ffffffffffffff x4 : 0300000005200470 x3 : 0300000005200470 [   55.012598] x2 : ffffff8101238000 x1 : 0000000000000021 x0 : 0300000005200470 [   55.013292] Call trace: [   55.013959]  __mutex_lock.constprop.0+0x90/0x608 [   55.014646]  __mutex_lock_slowpath+0x1c/0x30 [   55.015317]  mutex_lock+0x50/0x68 [   55.015961]  v3d_perfmon_stop+0x40/0xe0 [v3d] [   55.016627]  v3d_bin_job_run+0x10c/0x2d8 [v3d] [   55.017282]  drm_sched_main+0x178/0x3f8 [gpu_sched] [   55.017921]  kthread+0x11c/0x128 [   55.018554]  ret_from_fork+0x10/0x20 [   55.019168] Code: f9400260 f1001c1f 54001ea9 927df000 (b9403401) [   55.019776] ---[ end trace 0000000000000000 ]--- [   55.020411] note: v3d_bin[166] exited with preempt_count 1  This issue arises because, upon closing the file descriptor (which happens when we interrupt `kmscube`), the active performance monitor is not stopped. Although all perfmons are destroyed in `v3d_perfmon_close_file()`, the active performance monitor\u0026apos;s pointer (`v3d-\u0026gt;active_perfmon`) is still retained.  If `kmscube` is run again, the driver will attempt to stop the active performance monitor using the stale pointer in `v3d-\u0026gt;active_perfmon`. However, this pointer is no longer valid because the previous process has already terminated, and all performance monitors associated with it have been destroyed and freed.  To fix this, when the active performance monitor belongs to a given process, explicitly stop it before destroying and freeing it.(CVE-2024-50031)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: xtables: avoid NFPROTO_UNSPEC where needed  syzbot managed to call xt_cluster match via ebtables:   WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780  [..]  ebt_do_table+0x174b/0x2a40  Module registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing.  As this is only useful to restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only.  Pablo points out that this is a general issue, direct users of the set/getsockopt interface can call into targets/matches that were only intended for use with ip(6)tables.  Check all UNSPEC matches and targets for similar issues:  - matches and targets are fine except if they assume skb_network_header()   is valid -- this is only true when called from inet layer: ip(6) stack   pulls the ip/ipv6 header into linear data area. - targets that return XT_CONTINUE or other xtables verdicts must be   restricted too, they are incompatbile with the ebtables traverser, e.g.   EBT_CONTINUE is a completely different value than XT_CONTINUE.  Most matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by ip(6)tables.  The MARK target is also used by arptables, so register for NFPROTO_ARP too.  While at it, bail out if connbytes fails to enable the corresponding conntrack family.  This change passes the selftests in iptables.git.(CVE-2024-50038)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net/sched: accept TCA_STAB only for root qdisc  Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers.  Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1]  We can\u0026apos;t support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage.  [1] [   88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [   88.798611] #PF: supervisor read access in kernel mode [   88.799014] #PF: error_code(0x0000) - not-present page [   88.799506] PGD 0 P4D 0 [   88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [   88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [   88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [   88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a \u0026lt;4c\u0026gt; 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00 All code ========    0: 0f b7 50 12           movzwl 0x12(%rax),%edx    4: 48 8d 04 d5 00 00 00  lea    0x0(,%rdx,8),%rax    b: 00    c: 48 89 d6              mov    %rdx,%rsi    f: 48 29 d0              sub    %rdx,%rax   12: 48 8b 91 c0 01 00 00  mov    0x1c0(%rcx),%rdx   19: 48 c1 e0 03           shl    $0x3,%rax   1d: 48 01 c2              add    %rax,%rdx   20: 66 83 7a 1a 00        cmpw   $0x0,0x1a(%rdx)   25: 7e c0                 jle    0xffffffffffffffe7   27: 48 8b 3a              mov    (%rdx),%rdi   2a:* 4c 8b 07              mov    (%rdi),%r8  \u0026lt;-- trapping instruction   2d: 4c 89 02              mov    %r8,(%rdx)   30: 49 89 50 08           mov    %rdx,0x8(%r8)   34: 48 c7 47 08 00 00 00  movq   $0x0,0x8(%rdi)   3b: 00   3c: 48                    rex.W   3d: c7                    .byte 0xc7   3e: 07                    (bad)  ...  Code starting with the faulting instruction ===========================================    0: 4c 8b 07              mov    (%rdi),%r8    3: 4c 89 02              mov    %r8,(%rdx)    6: 49 89 50 08           mov    %rdx,0x8(%r8)    a: 48 c7 47 08 00 00 00  movq   $0x0,0x8(%rdi)   11: 00   12: 48                    rex.W   13: c7                    .byte 0xc7   14: 07                    (bad)  ... [   88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206 [   88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800 [   88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000 [   88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f [   88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140 [   88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac [   88.806734] FS:  00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000 [   88.807225] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [   88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0 [   88.808165] Call Trace: [   88.808459]  \u0026lt;TASK\u0026gt; [   88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [   88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715) [   88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [   88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [   88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [   88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq [   88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g ---truncated---(CVE-2024-50039)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: br_netfilter: fix panic with metadata_dst skb  Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit.  It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded  When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata-\u0026gt;dst.dev is NULL.  Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there\u0026apos;s a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.  The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst-\u0026gt;dev, thus the crash.  This case was never supported in the first place, so drop the packet instead.  PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [  176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [  176.292101] Mem abort info: [  176.292184]   ESR = 0x0000000096000004 [  176.292322]   EC = 0x25: DABT (current EL), IL = 32 bits [  176.292530]   SET = 0, FnV = 0 [  176.292709]   EA = 0, S1PTW = 0 [  176.292862]   FSC = 0x04: level 0 translation fault [  176.293013] Data abort info: [  176.293104]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [  176.293488]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [  176.293787]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [  176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [  176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [  176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [  176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [  176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [  176.296314] Hardware name: linux,dummy-virt (DT) [  176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [  176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [  176.297636] sp : ffff800080003630 [  176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [  176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [  176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [  176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [  176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [  176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [  176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [  176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [  176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [  176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [  176.300889] Call trace: [  176.301123]  br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.301411]  br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [  176.301703]  nf_hook_slow+0x48/0x124 [  176.302060]  br_forward_finish+0xc8/0xe8 [bridge] [  176.302371]  br_nf_hook_thresh+0x124/0x134 [br_netfilter] [  176.302605]  br_nf_forward_finish+0x118/0x22c [br_netfilter] [  176.302824]  br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [  176.303136]  br_nf_forward+0x2b8/0x4e0 [br_netfilter] [  176.303359]  nf_hook_slow+0x48/0x124 [  176.303 ---truncated---(CVE-2024-50045)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/rtrs-srv: Avoid null pointer deref during path establishment  For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.  So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.(CVE-2024-50062)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow  Syzkaller reported this splat:    ==================================================================   BUG: KASAN: slab-use-after-free in mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881   Read of size 4 at addr ffff8880569ac858 by task syz.1.2799/14662    CPU: 0 UID: 0 PID: 14662 Comm: syz.1.2799 Not tainted 6.12.0-rc2-syzkaller-00307-g36c254515dc6 #0   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014   Call Trace:    \u0026lt;TASK\u0026gt;    __dump_stack lib/dump_stack.c:94 [inline]    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120    print_address_description mm/kasan/report.c:377 [inline]    print_report+0xc3/0x620 mm/kasan/report.c:488    kasan_report+0xd9/0x110 mm/kasan/report.c:601    mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881    mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:914 [inline]    mptcp_nl_remove_id_zero_address+0x305/0x4a0 net/mptcp/pm_netlink.c:1572    mptcp_pm_nl_del_addr_doit+0x5c9/0x770 net/mptcp/pm_netlink.c:1603    genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]    genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210    netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2551    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219    netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]    netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1357    netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901    sock_sendmsg_nosec net/socket.c:729 [inline]    __sock_sendmsg net/socket.c:744 [inline]    ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2607    ___sys_sendmsg+0x135/0x1e0 net/socket.c:2661    __sys_sendmsg+0x117/0x1f0 net/socket.c:2690    do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]    __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386    do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411    entry_SYSENTER_compat_after_hwframe+0x84/0x8e   RIP: 0023:0xf7fe4579   Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 \u0026lt;5d\u0026gt; 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00   RSP: 002b:00000000f574556c EFLAGS: 00000296 ORIG_RAX: 0000000000000172   RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000020000140   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000   RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000   R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000    \u0026lt;/TASK\u0026gt;    Allocated by task 5387:    kasan_save_stack+0x33/0x60 mm/kasan/common.c:47    kasan_save_track+0x14/0x30 mm/kasan/common.c:68    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]    __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394    kmalloc_noprof include/linux/slab.h:878 [inline]    kzalloc_noprof include/linux/slab.h:1014 [inline]    subflow_create_ctx+0x87/0x2a0 net/mptcp/subflow.c:1803    subflow_ulp_init+0xc3/0x4d0 net/mptcp/subflow.c:1956    __tcp_set_ulp net/ipv4/tcp_ulp.c:146 [inline]    tcp_set_ulp+0x326/0x7f0 net/ipv4/tcp_ulp.c:167    mptcp_subflow_create_socket+0x4ae/0x10a0 net/mptcp/subflow.c:1764    __mptcp_subflow_connect+0x3cc/0x1490 net/mptcp/subflow.c:1592    mptcp_pm_create_subflow_or_signal_addr+0xbda/0x23a0 net/mptcp/pm_netlink.c:642    mptcp_pm_nl_fully_established net/mptcp/pm_netlink.c:650 [inline]    mptcp_pm_nl_work+0x3a1/0x4f0 net/mptcp/pm_netlink.c:943    mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2777    process_one_work+0x958/0x1b30 kernel/workqueue.c:3229    process_scheduled_works kernel/workqueue.c:3310 [inline]    worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391    kthread+0x2c1/0x3a0 kernel/kthread.c:389    ret_from_fork+0x45/0x80 arch/x86/ke ---truncated---(CVE-2024-50085)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  thermal: intel: int340x: processor: Fix warning during module unload  The processor_thermal driver uses pcim_device_enable() to enable a PCI device, which means the device will be automatically disabled on driver detach.  Thus there is no need to call pci_disable_device() again on it.  With recent PCI device resource management improvements, e.g. commit f748a07a0b64 (\u0026quot;PCI: Remove legacy pcim_release()\u0026quot;), this problem is exposed and triggers the warining below.   [  224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device  [  224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100  ...  [  224.010844] Call Trace:  [  224.010845]  \u0026lt;TASK\u0026gt;  [  224.010847]  ? show_regs+0x6d/0x80  [  224.010851]  ? __warn+0x8c/0x140  [  224.010854]  ? pci_disable_device+0xe5/0x100  [  224.010856]  ? report_bug+0x1c9/0x1e0  [  224.010859]  ? handle_bug+0x46/0x80  [  224.010862]  ? exc_invalid_op+0x1d/0x80  [  224.010863]  ? asm_exc_invalid_op+0x1f/0x30  [  224.010867]  ? pci_disable_device+0xe5/0x100  [  224.010869]  ? pci_disable_device+0xe5/0x100  [  224.010871]  ? kfree+0x21a/0x2b0  [  224.010873]  pcim_disable_device+0x20/0x30  [  224.010875]  devm_action_release+0x16/0x20  [  224.010878]  release_nodes+0x47/0xc0  [  224.010880]  devres_release_all+0x9f/0xe0  [  224.010883]  device_unbind_cleanup+0x12/0x80  [  224.010885]  device_release_driver_internal+0x1ca/0x210  [  224.010887]  driver_detach+0x4e/0xa0  [  224.010889]  bus_remove_driver+0x6f/0xf0  [  224.010890]  driver_unregister+0x35/0x60  [  224.010892]  pci_unregister_driver+0x44/0x90  [  224.010894]  proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci]  ...  [  224.010921] ---[ end trace 0000000000000000 ]---  Remove the excess pci_disable_device() calls.  [ rjw: Subject and changelog edits ](CVE-2024-50093)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down  There is a history of deadlock if reboot is performed at the beginning of booting. SDEV_QUIESCE was set for all LU\u0026apos;s scsi_devices by UFS shutdown, and at that time the audio driver was waiting on blk_mq_submit_bio() holding a mutex_lock while reading the fw binary. After that, a deadlock issue occurred while audio driver shutdown was waiting for mutex_unlock of blk_mq_submit_bio(). To solve this, set SDEV_OFFLINE for all LUs except WLUN, so that any I/O that comes down after a UFS shutdown will return an error.  [   31.907781]I[0:      swapper/0:    0]        1        130705007       1651079834      11289729804                0 D(   2) 3 ffffff882e208000 *             init [device_shutdown] [   31.907793]I[0:      swapper/0:    0] Mutex: 0xffffff8849a2b8b0: owner[0xffffff882e28cb00 kworker/6:0 :49] [   31.907806]I[0:      swapper/0:    0] Call trace: [   31.907810]I[0:      swapper/0:    0]  __switch_to+0x174/0x338 [   31.907819]I[0:      swapper/0:    0]  __schedule+0x5ec/0x9cc [   31.907826]I[0:      swapper/0:    0]  schedule+0x7c/0xe8 [   31.907834]I[0:      swapper/0:    0]  schedule_preempt_disabled+0x24/0x40 [   31.907842]I[0:      swapper/0:    0]  __mutex_lock+0x408/0xdac [   31.907849]I[0:      swapper/0:    0]  __mutex_lock_slowpath+0x14/0x24 [   31.907858]I[0:      swapper/0:    0]  mutex_lock+0x40/0xec [   31.907866]I[0:      swapper/0:    0]  device_shutdown+0x108/0x280 [   31.907875]I[0:      swapper/0:    0]  kernel_restart+0x4c/0x11c [   31.907883]I[0:      swapper/0:    0]  __arm64_sys_reboot+0x15c/0x280 [   31.907890]I[0:      swapper/0:    0]  invoke_syscall+0x70/0x158 [   31.907899]I[0:      swapper/0:    0]  el0_svc_common+0xb4/0xf4 [   31.907909]I[0:      swapper/0:    0]  do_el0_svc+0x2c/0xb0 [   31.907918]I[0:      swapper/0:    0]  el0_svc+0x34/0xe0 [   31.907928]I[0:      swapper/0:    0]  el0t_64_sync_handler+0x68/0xb4 [   31.907937]I[0:      swapper/0:    0]  el0t_64_sync+0x1a0/0x1a4  [   31.908774]I[0:      swapper/0:    0]       49                0         11960702      11236868007                0 D(   2) 6 ffffff882e28cb00 *      kworker/6:0 [__bio_queue_enter] [   31.908783]I[0:      swapper/0:    0] Call trace: [   31.908788]I[0:      swapper/0:    0]  __switch_to+0x174/0x338 [   31.908796]I[0:      swapper/0:    0]  __schedule+0x5ec/0x9cc [   31.908803]I[0:      swapper/0:    0]  schedule+0x7c/0xe8 [   31.908811]I[0:      swapper/0:    0]  __bio_queue_enter+0xb8/0x178 [   31.908818]I[0:      swapper/0:    0]  blk_mq_submit_bio+0x194/0x67c [   31.908827]I[0:      swapper/0:    0]  __submit_bio+0xb8/0x19c(CVE-2024-50098)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context  PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services.  The issue arises because the PRMT is finding a block of type EFI_CONVENTIONAL_MEMORY, which is not appropriate for runtime services as described in Section 2.2.2 (Runtime Services) of the UEFI Specification [1]. Since the PRM handler is a type of runtime service, this causes an exception when the PRM handler is called.      [Firmware Bug]: Unable to handle paging request in EFI runtime service     WARNING: CPU: 22 PID: 4330 at drivers/firmware/efi/runtime-wrappers.c:341         __efi_queue_work+0x11c/0x170     Call trace:  Let PRMT find a block with EFI_MEMORY_RUNTIME for PRM handler and PRM context.  If no suitable block is found, a warning message will be printed, but the procedure continues to manage the next PRM handler.  However, if the PRM handler is actually called without proper allocation, it would result in a failure during error handling.  By using the correct memory types for runtime services, ensure that the PRM handler and the context are properly mapped in the virtual address space during runtime, preventing the paging request error.  The issue is really that only memory that has been remapped for runtime by the firmware can be used by the PRM handler, and so the region needs to have the EFI_MEMORY_RUNTIME attribute.  [ rjw: Subject and changelog edits ](CVE-2024-50141)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  udf: fix uninit-value use in udf_get_fileshortad  Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].  [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000(CVE-2024-50143)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: bnep: fix wild-memory-access in proto_unregister  There\u0026apos;s issue as follows:   KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f]   CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G        W   RIP: 0010:proto_unregister+0xee/0x400   Call Trace:    \u0026lt;TASK\u0026gt;    __do_sys_delete_module+0x318/0x580    do_syscall_64+0xc1/0x1d0    entry_SYSCALL_64_after_hwframe+0x77/0x7f  As bnep_init() ignore bnep_sock_init()\u0026apos;s return value, and bnep_sock_init() will cleanup all resource. Then when remove bnep module will call bnep_sock_cleanup() to cleanup sock\u0026apos;s resource. To solve above issue just return bnep_sock_init()\u0026apos;s return value in bnep_exit().(CVE-2024-50148)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  tcp/dccp: Don\u0026apos;t use timer_pending() in reqsk_queue_unlink().  Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().    \u0026quot;\u0026quot;\u0026quot;   We are seeing a use-after-free from a bpf prog attached to   trace_tcp_retransmit_synack. The program passes the req-\u0026gt;sk to the   bpf_sk_storage_get_tracing kernel helper which does check for null   before using it.   \u0026quot;\u0026quot;\u0026quot;  The commit 83fccfc3940c (\u0026quot;inet: fix potential deadlock in reqsk_queue_unlink()\u0026quot;) added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window.  Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer-\u0026gt;entry.pprev and marks it as not pending.  If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires.  The reported UAF could happen if req-\u0026gt;sk is close()d earlier than the timer expiration, which is 63s by default.  The scenario would be    1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(),      but del_timer_sync() is missed    2. reqsk timer is executed and scheduled again    3. req-\u0026gt;sk is accept()ed and reqsk_put() decrements rsk_refcnt, but      reqsk timer still has another one, and inet_csk_accept() does not      clear req-\u0026gt;sk for non-TFO sockets    4. sk is close()d    5. reqsk timer is executed again, and BPF touches req-\u0026gt;sk  Let\u0026apos;s not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop().  Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1]  [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0  Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb  kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6  allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb  freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb(CVE-2024-50154)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop  Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processors, if the rate of DB is very high.  Add a loop count for FPGA and exit the __wait_for_fifo_occupancy_below_th if the loop is taking more time. Pacing will be continuing until the occupancy is below the threshold. This is ensured by the checks in bnxt_re_pacing_timer_exp and further scheduling the work for pacing based on the fifo occupancy.(CVE-2024-50157)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: devmap: provide rxq after redirect  rxq contains a pointer to the device from where the redirect happened. Currently, the BPF program that was executed after a redirect via BPF_MAP_TYPE_DEVMAP* does not have it set.  This is particularly bad since accessing ingress_ifindex, e.g.  SEC(\u0026quot;xdp\u0026quot;) int prog(struct xdp_md *pkt) {         return bpf_redirect_map(\u0026amp;dev_redirect_map, 0, 0); }  SEC(\u0026quot;xdp/devmap\u0026quot;) int prog_after_redirect(struct xdp_md *pkt) {         bpf_printk(\u0026quot;ifindex %i\u0026quot;, pkt-\u0026gt;ingress_ifindex);         return XDP_PASS; }  depends on access to rxq, so a NULL pointer gets dereferenced:  \u0026lt;1\u0026gt;[  574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000 \u0026lt;1\u0026gt;[  574.475188] #PF: supervisor read access in kernel mode \u0026lt;1\u0026gt;[  574.475194] #PF: error_code(0x0000) - not-present page \u0026lt;6\u0026gt;[  574.475199] PGD 0 P4D 0 \u0026lt;4\u0026gt;[  574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI \u0026lt;4\u0026gt;[  574.475217] CPU: 4 UID: 0 PID: 217 Comm: kworker/4:1 Not tainted 6.11.0-rc5-reduced-00859-g780801200300 #23 \u0026lt;4\u0026gt;[  574.475226] Hardware name: Intel(R) Client Systems NUC13ANHi7/NUC13ANBi7, BIOS ANRPL357.0026.2023.0314.1458 03/14/2023 \u0026lt;4\u0026gt;[  574.475231] Workqueue: mld mld_ifc_work \u0026lt;4\u0026gt;[  574.475247] RIP: 0010:bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c \u0026lt;4\u0026gt;[  574.475257] Code: cc cc cc cc cc cc cc 80 00 00 00 cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 57 20 \u0026lt;48\u0026gt; 8b 52 00 8b 92 e0 00 00 00 48 bf f8 a6 d5 c4 5d a0 ff ff be 0b \u0026lt;4\u0026gt;[  574.475263] RSP: 0018:ffffa62440280c98 EFLAGS: 00010206 \u0026lt;4\u0026gt;[  574.475269] RAX: ffffa62440280cd8 RBX: 0000000000000001 RCX: 0000000000000000 \u0026lt;4\u0026gt;[  574.475274] RDX: 0000000000000000 RSI: ffffa62440549048 RDI: ffffa62440280ce0 \u0026lt;4\u0026gt;[  574.475278] RBP: ffffa62440280c98 R08: 0000000000000002 R09: 0000000000000001 \u0026lt;4\u0026gt;[  574.475281] R10: ffffa05dc8b98000 R11: ffffa05f577fca40 R12: ffffa05dcab24000 \u0026lt;4\u0026gt;[  574.475285] R13: ffffa62440280ce0 R14: ffffa62440549048 R15: ffffa62440549000 \u0026lt;4\u0026gt;[  574.475289] FS:  0000000000000000(0000) GS:ffffa05f4f700000(0000) knlGS:0000000000000000 \u0026lt;4\u0026gt;[  574.475294] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 \u0026lt;4\u0026gt;[  574.475298] CR2: 0000000000000000 CR3: 000000025522e000 CR4: 0000000000f50ef0 \u0026lt;4\u0026gt;[  574.475303] PKRU: 55555554 \u0026lt;4\u0026gt;[  574.475306] Call Trace: \u0026lt;4\u0026gt;[  574.475313]  \u0026lt;IRQ\u0026gt; \u0026lt;4\u0026gt;[  574.475318]  ? __die+0x23/0x70 \u0026lt;4\u0026gt;[  574.475329]  ? page_fault_oops+0x180/0x4c0 \u0026lt;4\u0026gt;[  574.475339]  ? skb_pp_cow_data+0x34c/0x490 \u0026lt;4\u0026gt;[  574.475346]  ? kmem_cache_free+0x257/0x280 \u0026lt;4\u0026gt;[  574.475357]  ? exc_page_fault+0x67/0x150 \u0026lt;4\u0026gt;[  574.475368]  ? asm_exc_page_fault+0x26/0x30 \u0026lt;4\u0026gt;[  574.475381]  ? bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c \u0026lt;4\u0026gt;[  574.475386]  bq_xmit_all+0x158/0x420 \u0026lt;4\u0026gt;[  574.475397]  __dev_flush+0x30/0x90 \u0026lt;4\u0026gt;[  574.475407]  veth_poll+0x216/0x250 [veth] \u0026lt;4\u0026gt;[  574.475421]  __napi_poll+0x28/0x1c0 \u0026lt;4\u0026gt;[  574.475430]  net_rx_action+0x32d/0x3a0 \u0026lt;4\u0026gt;[  574.475441]  handle_softirqs+0xcb/0x2c0 \u0026lt;4\u0026gt;[  574.475451]  do_softirq+0x40/0x60 \u0026lt;4\u0026gt;[  574.475458]  \u0026lt;/IRQ\u0026gt; \u0026lt;4\u0026gt;[  574.475461]  \u0026lt;TASK\u0026gt; \u0026lt;4\u0026gt;[  574.475464]  __local_bh_enable_ip+0x66/0x70 \u0026lt;4\u0026gt;[  574.475471]  __dev_queue_xmit+0x268/0xe40 \u0026lt;4\u0026gt;[  574.475480]  ? selinux_ip_postroute+0x213/0x420 \u0026lt;4\u0026gt;[  574.475491]  ? alloc_skb_with_frags+0x4a/0x1d0 \u0026lt;4\u0026gt;[  574.475502]  ip6_finish_output2+0x2be/0x640 \u0026lt;4\u0026gt;[  574.475512]  ? nf_hook_slow+0x42/0xf0 \u0026lt;4\u0026gt;[  574.475521]  ip6_finish_output+0x194/0x300 \u0026lt;4\u0026gt;[  574.475529]  ? __pfx_ip6_finish_output+0x10/0x10 \u0026lt;4\u0026gt;[  574.475538]  mld_sendpack+0x17c/0x240 \u0026lt;4\u0026gt;[  574.475548]  mld_ifc_work+0x192/0x410 \u0026lt;4\u0026gt;[  574.475557]  process_one_work+0x15d/0x380 \u0026lt;4\u0026gt;[  574.475566]  worker_thread+0x29d/0x3a0 \u0026lt;4\u0026gt;[  574.475573]  ? __pfx_worker_thread+0x10/0x10 \u0026lt;4\u0026gt;[  574.475580]  ? __pfx_worker_thread+0x10/0x10 \u0026lt;4\u0026gt;[  574.475587]  kthread+0xcd/0x100 \u0026lt;4\u0026gt;[  574.475597]  ? __pfx_kthread+0x10/0x10 \u0026lt;4\u0026gt;[  574.475606]  ret_from_fork+0x31/0x50 \u0026lt;4\u0026gt;[  574.475615]  ? __pfx_kthread+0x10/0x10 \u0026lt;4\u0026gt;[  574.475623]  ret_from_fork_asm+0x1a/0x ---truncated---(CVE-2024-50162)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  fsl/fman: Fix refcount handling of fman-related devices  In mac_probe() there are multiple calls to of_find_device_by_node(), fman_bind() and fman_port_bind() which takes references to of_dev-\u0026gt;dev. Not all references taken by these calls are released later on error path in mac_probe() and in mac_remove() which lead to reference leaks.  Add references release.(CVE-2024-50166)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  vsock: Update rx_bytes on read_skb()  Make sure virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt() calls are balanced (i.e. virtio_vsock_sock::rx_bytes doesn\u0026apos;t lie) after vsock_transport::read_skb().  While here, also inform the peer that we\u0026apos;ve freed up space and it has more credit.  Failing to update rx_bytes after packet is dequeued leads to a warning on SOCK_STREAM recv():  [  233.396654] rx_queue is empty, but rx_bytes is non-zero [  233.396702] WARNING: CPU: 11 PID: 40601 at net/vmw_vsock/virtio_transport_common.c:589(CVE-2024-50169)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: bcmasp: fix potential memory leak in bcmasp_xmit()  The bcmasp_xmit() returns NETDEV_TX_OK without freeing skb in case of mapping fails, add dev_kfree_skb() to fix it.(CVE-2024-50170)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: systemport: fix potential memory leak in bcm_sysport_xmit()  The bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb in case of dma_map_single() fails, add dev_kfree_skb() to fix it.(CVE-2024-50171)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  secretmem: disable memfd_secret() if arch cannot set direct map  Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map().  This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not present can only be done if the direct map is set up at 4k granularity in the first place (as ARM\u0026apos;s break-before-make semantics do not easily allow breaking apart large/gigantic pages).  More precisely, on arm64 systems with !can_set_direct_map(), set_direct_map_invalid_noflush() is a no-op, however it returns success (0) instead of an error.  This means that memfd_secret will seemingly \u0026quot;work\u0026quot; (e.g.  syscall succeeds, you can mmap the fd and fault in pages), but it does not actually achieve its goal of removing its memory from the direct map.  Note that with this patch, memfd_secret() will start erroring on systems where can_set_direct_map() returns false (arm64 with CONFIG_RODATA_FULL_DEFAULT_ENABLED=n, CONFIG_DEBUG_PAGEALLOC=n and CONFIG_KFENCE=n), but that still seems better than the current silent failure.  Since CONFIG_RODATA_FULL_DEFAULT_ENABLED defaults to \u0026apos;y\u0026apos;, most arm64 systems actually have a working memfd_secret() and aren\u0026apos;t be affected.  From going through the iterations of the original memfd_secret patch series, it seems that disabling the syscall in these scenarios was the intended behavior [1] (preferred over having set_direct_map_invalid_noflush return an error as that would result in SIGBUSes at page-fault time), however the check for it got dropped between v16 [2] and v17 [3], when secretmem moved away from CMA allocations.  [1]: https://lore.kernel.org/lkml/20201124164930.GK8537@kernel.org/ [2]: https://lore.kernel.org/lkml/20210121122723.3446-11-rppt@kernel.org/#t [3]: https://lore.kernel.org/lkml/20201125092208.12544-10-rppt@kernel.org/(CVE-2024-50182)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ext4: don\u0026apos;t set SB_RDONLY after filesystem errors  When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb-\u0026gt;s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn\u0026apos;t be needed. So stop doing that.(CVE-2024-50191)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  irqchip/gic-v4: Don\u0026apos;t allow a VMOVP on a dying VPE  Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/.  Plug the race by checking the value of vmapp_count, which tracks whether the VPE is mapped ot not, and returning an error in this case.  This involves making vmapp_count common to both GICv4.1 and its v4.0 ancestor.(CVE-2024-50192)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  posix-clock: Fix missing timespec64 check in pc_clock_settime()  As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct\u0026apos;s tv_sec and tv_nsec range before calling ptp-\u0026gt;info-\u0026gt;settime64().  As the man manual of clock_settime() said, if tp.tv_sec is negative or tp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL, which include dynamic clocks which handles PTP clock, and the condition is consistent with timespec64_valid(). As Thomas suggested, timespec64_valid() only check the timespec is valid, but not ensure that the time is in a valid range, so check it ahead using timespec64_valid_strict() in pc_clock_settime() and return -EINVAL if not valid.  There are some drivers that use tp-\u0026gt;tv_sec and tp-\u0026gt;tv_nsec directly to write registers without validity checks and assume that the higher layer has checked it, which is dangerous and will benefit from this, such as hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(), and some drivers can remove the checks of itself.(CVE-2024-50195)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf, arm64: Fix address emission with tag-based KASAN enabled  When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission.(CVE-2024-50203)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()  The step variable is initialized to zero. It is changed in the loop, but if it\u0026apos;s not changed it will remain zero. Add a variable check before the division.  The observed behavior was introduced by commit 826b5de90c0b (\u0026quot;ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size\u0026quot;), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50205)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages  Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages \u0026gt; 256K.  There will be a single PDE page address (contiguous pages in the case of \u0026gt; PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid memory access after 256K PBL entries in the PDE.(CVE-2024-50208)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Add a check for memory allocation  __alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances.(CVE-2024-50209)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  xfs: fix finding a last resort AG in xfs_filestream_pick_ag  When the main loop in xfs_filestream_pick_ag fails to find a suitable AG it tries to just pick the online AG.  But the loop for that uses args-\u0026gt;pag as loop iterator while the later code expects pag to be set.  Fix this by reusing the max_pag case for this last resort, and also add a check for impossible case of no AG just to make sure that the uninitialized pag doesn\u0026apos;t even escape in theory.(CVE-2024-50216)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()  Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable \u0026apos;device-\u0026gt;bdev_file\u0026apos; in __btrfs_free_extra_devids(). And following are the details:  1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs    devices by ioctl(BTRFS_IOC_SCAN_DEV):               /  btrfs_device_1 → loop0    fs_device              \\  btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt    btrfs_open_devices     btrfs_device_1-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop0)     btrfs_device_2-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop1)    btrfs_fill_super     open_ctree      fail: btrfs_close_devices // -ENOMEM      btrfs_close_bdev(btrfs_device_1)              fput(btrfs_device_1-\u0026gt;bdev_file)        // btrfs_device_1-\u0026gt;bdev_file is freed      btrfs_close_bdev(btrfs_device_2)              fput(btrfs_device_2-\u0026gt;bdev_file)  3. mount /dev/loop1 /mnt    btrfs_open_devices     btrfs_get_bdev_and_sb(\u0026amp;bdev_file)      // EIO, btrfs_device_1-\u0026gt;bdev_file is not assigned,      // which points to a freed memory area     btrfs_device_2-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop1)    btrfs_fill_super     open_ctree      btrfs_free_extra_devids       if (btrfs_device_1-\u0026gt;bdev_file)        fput(btrfs_device_1-\u0026gt;bdev_file) // UAF !  Fix it by setting \u0026apos;device-\u0026gt;bdev_file\u0026apos; as \u0026apos;NULL\u0026apos; after closing the btrfs_device in btrfs_close_one_device().(CVE-2024-50217)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sched/numa: Fix the potential null pointer dereference in task_numa_work()  When running stress-ng-vm-segv test, we found a null pointer dereference error in task_numa_work(). Here is the backtrace:    [323676.066985] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020   ......   [323676.067108] CPU: 35 PID: 2694524 Comm: stress-ng-vm-se   ......   [323676.067113] pstate: 23401009 (nzCv daif +PAN -UAO +TCO +DIT +SSBS BTYPE=--)   [323676.067115] pc : vma_migratable+0x1c/0xd0   [323676.067122] lr : task_numa_work+0x1ec/0x4e0   [323676.067127] sp : ffff8000ada73d20   [323676.067128] x29: ffff8000ada73d20 x28: 0000000000000000 x27: 000000003e89f010   [323676.067130] x26: 0000000000080000 x25: ffff800081b5c0d8 x24: ffff800081b27000   [323676.067133] x23: 0000000000010000 x22: 0000000104d18cc0 x21: ffff0009f7158000   [323676.067135] x20: 0000000000000000 x19: 0000000000000000 x18: ffff8000ada73db8   [323676.067138] x17: 0001400000000000 x16: ffff800080df40b0 x15: 0000000000000035   [323676.067140] x14: ffff8000ada73cc8 x13: 1fffe0017cc72001 x12: ffff8000ada73cc8   [323676.067142] x11: ffff80008001160c x10: ffff000be639000c x9 : ffff8000800f4ba4   [323676.067145] x8 : ffff000810375000 x7 : ffff8000ada73974 x6 : 0000000000000001   [323676.067147] x5 : 0068000b33e26707 x4 : 0000000000000001 x3 : ffff0009f7158000   [323676.067149] x2 : 0000000000000041 x1 : 0000000000004400 x0 : 0000000000000000   [323676.067152] Call trace:   [323676.067153]  vma_migratable+0x1c/0xd0   [323676.067155]  task_numa_work+0x1ec/0x4e0   [323676.067157]  task_work_run+0x78/0xd8   [323676.067161]  do_notify_resume+0x1ec/0x290   [323676.067163]  el0_svc+0x150/0x160   [323676.067167]  el0t_64_sync_handler+0xf8/0x128   [323676.067170]  el0t_64_sync+0x17c/0x180   [323676.067173] Code: d2888001 910003fd f9000bf3 aa0003f3 (f9401000)   [323676.067177] SMP: stopping secondary CPUs   [323676.070184] Starting crashdump kernel...  stress-ng-vm-segv in stress-ng is used to stress test the SIGSEGV error handling function of the system, which tries to cause a SIGSEGV error on return from unmapping the whole address space of the child process.  Normally this program will not cause kernel crashes. But before the munmap system call returns to user mode, a potential task_numa_work() for numa balancing could be added and executed. In this scenario, since the child process has no vma after munmap, the vma_next() in task_numa_work() will return a null pointer even if the vma iterator restarts from 0.  Recheck the vma pointer before dereferencing it in task_numa_work().(CVE-2024-50223)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix kernel bug due to missing clearing of checked flag  Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug.  This was found to be because the \u0026quot;checked\u0026quot; flag of a page/folio was not cleared when it was discarded by nilfs2\u0026apos;s own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded.  So, fix that.  This was necessary when the use of nilfs2\u0026apos;s own page discard routine was applied to more than just metadata files.(CVE-2024-50230)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: iwlegacy: Clear stale interrupts before resuming device  iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn\u0026apos;t being cleared out before interrupts are enabled. We end up with a race beween the resume trying to bring things back up, and the restart work (queued form the interrupt handler) trying to bring things down. Eventually the whole thing blows up.  Fix the problem by clearing out any stale interrupts before interrupts get enabled during resume.  Here\u0026apos;s a debug log of the indicent: [   12.042589] ieee80211 phy0: il_isr ISR inta 0x00000080, enabled 0xaa00008b, fh 0x00000000 [   12.042625] ieee80211 phy0: il4965_irq_tasklet inta 0x00000080, enabled 0x00000000, fh 0x00000000 [   12.042651] iwl4965 0000:10:00.0: RF_KILL bit toggled to enable radio. [   12.042653] iwl4965 0000:10:00.0: On demand firmware reload [   12.042690] ieee80211 phy0: il4965_irq_tasklet End inta 0x00000000, enabled 0xaa00008b, fh 0x00000000, flags 0x00000282 [   12.052207] ieee80211 phy0: il4965_mac_start enter [   12.052212] ieee80211 phy0: il_prep_station Add STA to driver ID 31: ff:ff:ff:ff:ff:ff [   12.052244] ieee80211 phy0: il4965_set_hw_ready hardware  ready [   12.052324] ieee80211 phy0: il_apm_init Init card\u0026apos;s basic functions [   12.052348] ieee80211 phy0: il_apm_init L1 Enabled; Disabling L0S [   12.055727] ieee80211 phy0: il4965_load_bsm Begin load bsm [   12.056140] ieee80211 phy0: il4965_verify_bsm Begin verify bsm [   12.058642] ieee80211 phy0: il4965_verify_bsm BSM bootstrap uCode image OK [   12.058721] ieee80211 phy0: il4965_load_bsm BSM write complete, poll 1 iterations [   12.058734] ieee80211 phy0: __il4965_up iwl4965 is coming up [   12.058737] ieee80211 phy0: il4965_mac_start Start UP work done. [   12.058757] ieee80211 phy0: __il4965_down iwl4965 is going down [   12.058761] ieee80211 phy0: il_scan_cancel_timeout Scan cancel timeout [   12.058762] ieee80211 phy0: il_do_scan_abort Not performing scan to abort [   12.058765] ieee80211 phy0: il_clear_ucode_stations Clearing ucode stations in driver [   12.058767] ieee80211 phy0: il_clear_ucode_stations No active stations found to be cleared [   12.058819] ieee80211 phy0: _il_apm_stop Stop card, put in low power state [   12.058827] ieee80211 phy0: _il_apm_stop_master stop master [   12.058864] ieee80211 phy0: il4965_clear_free_frames 0 frames on pre-allocated heap on clear. [   12.058869] ieee80211 phy0: Hardware restart was requested [   16.132299] iwl4965 0000:10:00.0: START_ALIVE timeout after 4000ms. [   16.132303] ------------[ cut here ]------------ [   16.132304] Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue. [   16.132338] WARNING: CPU: 0 PID: 181 at net/mac80211/util.c:1826 ieee80211_reconfig+0x8f/0x14b0 [mac80211] [   16.132390] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev [   16.132456] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Not tainted 6.11.0-cl+ #143 [   16.132460] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010 [   16.132463] Workqueue: async async_run_entry_fn [   16.132469] RIP: 0010:ieee80211_reconfig+0x8f/0x14b0 [mac80211] [   16.132501] Code: da 02 00 0 ---truncated---(CVE-2024-50234)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: ath10k: Fix memory leak in management tx  In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic.  Kmemleak reports this problem as below,  unreferenced object 0xffffff80b64ed250 (size 16):   comm \u0026quot;kworker/u16:7\u0026quot;, pid 148, jiffies 4294687130 (age 714.199s)   hex dump (first 16 bytes):     00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00  .+.......t......   backtrace:     [\u0026lt;ffffffe6e7b245dc\u0026gt;] __kmem_cache_alloc_node+0x1e4/0x2d8     [\u0026lt;ffffffe6e7adde88\u0026gt;] kmalloc_trace+0x48/0x110     [\u0026lt;ffffffe6bbd765fc\u0026gt;] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core]     [\u0026lt;ffffffe6bbd3eed4\u0026gt;] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core]     [\u0026lt;ffffffe6e78d5974\u0026gt;] process_scheduled_works+0x1ac/0x400     [\u0026lt;ffffffe6e78d60b8\u0026gt;] worker_thread+0x208/0x328     [\u0026lt;ffffffe6e78dc890\u0026gt;] kthread+0x100/0x1c0     [\u0026lt;ffffffe6e78166c0\u0026gt;] ret_from_fork+0x10/0x20  Free the memory during completion and cleanup to fix the leak.  Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar-\u0026gt;data_lock similar to other instances.  Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1(CVE-2024-50236)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Initialize struct nfsd4_copy earlier  Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.(CVE-2024-50241)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ntfs3: Add bounds checking to mi_enum_attr()  Added bounds checking to make sure that every attr don\u0026apos;t stray beyond valid memory region.(CVE-2024-50248)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs  Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes.  __hci_cmd_sync_sk() returns NULL if a command returns a status event. However, it also returns NULL where an opcode doesn\u0026apos;t exist in the hci_cc table because hci_cmd_complete_evt() assumes status = skb-\u0026gt;data[0] for unknown opcodes. This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes status = skb-\u0026gt;data[0].  KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci7 hci_power_on RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138 Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 \u0026lt;0f\u0026gt; b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78 RSP: 0018:ffff888120bafac8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040 RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4 RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054 R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000 FS:  0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace:  \u0026lt;TASK\u0026gt;  hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline]  hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline]  hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline]  hci_init_sync net/bluetooth/hci_sync.c:4742 [inline]  hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline]  hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994  hci_dev_do_open net/bluetooth/hci_core.c:483 [inline]  hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015  process_one_work kernel/workqueue.c:3267 [inline]  process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348  worker_thread+0x91f/0xe50 kernel/workqueue.c:3429  kthread+0x2cb/0x360 kernel/kthread.c:388  ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244(CVE-2024-50255)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: fix crash when config small gso_max_size/gso_ipv4_max_size  Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk-\u0026gt;sk_gso_max_size would be much bigger than device limits. Call Trace: tcp_write_xmit     tso_segs = tcp_init_tso_segs(skb, mss_now);         tcp_set_skb_tso_segs             tcp_skb_pcount_set                 // skb-\u0026gt;len = 524288, mss_now = 8                 // u16 tso_segs = 524288/8 = 65535 -\u0026gt; 0                 tso_segs = DIV_ROUND_UP(skb-\u0026gt;len, mss_now)     BUG_ON(!tso_segs) Add check for the minimum value of gso_max_size and gso_ipv4_max_size.(CVE-2024-50258)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: Fix out-of-bounds write in trie_get_next_key()  trie_get_next_key() allocates a node stack with size trie-\u0026gt;max_prefixlen, while it writes (trie-\u0026gt;max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.(CVE-2024-50262)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()  Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():  [   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry [   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [   57.331328] Call Trace: [   57.331477]  \u0026lt;TASK\u0026gt; [...] [   57.333511]  ? do_user_addr_fault+0x3e5/0x740 [   57.333778]  ? exc_page_fault+0x70/0x170 [   57.334016]  ? asm_exc_page_fault+0x2b/0x30 [   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0 [   57.335164]  ocfs2_xa_set+0x704/0xcf0 [   57.335381]  ? _raw_spin_unlock+0x1a/0x40 [   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20 [   57.335915]  ? trace_preempt_on+0x1e/0x70 [   57.336153]  ? start_this_handle+0x16c/0x500 [   57.336410]  ? preempt_count_sub+0x50/0x80 [   57.336656]  ? _raw_read_unlock+0x20/0x40 [   57.336906]  ? start_this_handle+0x16c/0x500 [   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0 [   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0 [   57.337706]  ? ocfs2_start_trans+0x13d/0x290 [   57.337971]  ocfs2_xattr_set+0xb13/0xfb0 [   57.338207]  ? dput+0x46/0x1c0 [   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30 [   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30 [   57.338948]  __vfs_removexattr+0x92/0xc0 [   57.339182]  __vfs_removexattr_locked+0xd5/0x190 [   57.339456]  ? preempt_count_sub+0x50/0x80 [   57.339705]  vfs_removexattr+0x5f/0x100 [...]  Reproducer uses faultinject facility to fail ocfs2_xa_remove() -\u0026gt; ocfs2_xa_value_truncate() with -ENOMEM.  In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following \u0026apos;rc\u0026apos; check is wrong and execution flow do \u0026apos;ocfs2_xa_remove_entry(loc);\u0026apos; twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to \u0026apos;out\u0026apos;.  Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy.(CVE-2024-50265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  usb: musb: sunxi: Fix accessing an released usb phy  Commit 6ed05c68cbca (\u0026quot;usb: musb: sunxi: Explicitly release USB PHY on exit\u0026quot;) will cause that usb phy @glue-\u0026gt;xceiv is accessed after released.  1) register platform driver @sunxi_musb_driver // get the usb phy @glue-\u0026gt;xceiv sunxi_musb_probe() -\u0026gt; devm_usb_get_phy().  2) register and unregister platform driver @musb_driver musb_probe() -\u0026gt; sunxi_musb_init() use the phy here //the phy is released here musb_remove() -\u0026gt; sunxi_musb_exit() -\u0026gt; devm_usb_put_phy()  3) register @musb_driver again musb_probe() -\u0026gt; sunxi_musb_init() use the phy here but the phy has been released at 2). ...  Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().(CVE-2024-50269)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  signal: restore the override_rlimit logic  Prior to commit d64696905554 (\u0026quot;Reimplement RLIMIT_SIGPENDING on top of ucounts\u0026quot;) UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of signals.  However now it\u0026apos;s enforced unconditionally, even if override_rlimit is set.  This behavior change caused production issues.    For example, if the limit is reached and a process receives a SIGSEGV signal, sigqueue_alloc fails to allocate the necessary resources for the signal delivery, preventing the signal from being delivered with siginfo.  This prevents the process from correctly identifying the fault address and handling the error.  From the user-space perspective, applications are unaware that the limit has been reached and that the siginfo is effectively \u0026apos;corrupted\u0026apos;.  This can lead to unpredictable behavior and crashes, as we observed with java applications.  Fix this by passing override_rlimit into inc_rlimit_get_ucounts() and skip the comparison to max there if override_rlimit is set.  This effectively restores the old behavior.(CVE-2024-50271)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  filemap: Fix bounds checking in filemap_read()  If the caller supplies an iocb-\u0026gt;ki_pos value that is close to the filesystem upper limit, and an iterator with a count that causes us to overflow that limit, then filemap_read() enters an infinite loop.  This behaviour was discovered when testing xfstests generic/525 with the \u0026quot;localio\u0026quot; optimisation for loopback NFS mounts.(CVE-2024-50272)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: reinitialize delayed ref list after deleting it from the list  At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0026apos;s ref_add_list using list_del(), which leaves the ref\u0026apos;s add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively.  If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref\u0026apos;s add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise.  So fix this by deleting from the list with list_del_init() instead.(CVE-2024-50273)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  arm64/sve: Discard stale CPU state when handling SVE traps  The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task having TIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state is stale (e.g. with SVE traps enabled). This has been observed to result in warnings from do_sve_acc() where SVE traps are not expected while TIF_SVE is set:  |         if (test_and_set_thread_flag(TIF_SVE)) |                 WARN_ON(1); /* SVE access shouldn\u0026apos;t have trapped */  Warnings of this form have been reported intermittently, e.g.    https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/   https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/  The race can occur when the SVE trap handler is preempted before and after manipulating the saved FPSIMD/SVE state, starting and ending on the same CPU, e.g.  | void do_sve_acc(unsigned long esr, struct pt_regs *regs) | { |         // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled |         // task-\u0026gt;fpsimd_cpu is 0. |         // per_cpu_ptr(\u0026amp;fpsimd_last_state, 0) is task. | |         ... | |         // Preempted; migrated from CPU 0 to CPU 1. |         // TIF_FOREIGN_FPSTATE is set. | |         get_cpu_fpsimd_context(); | |         if (test_and_set_thread_flag(TIF_SVE)) |                 WARN_ON(1); /* SVE access shouldn\u0026apos;t have trapped */ | |         sve_init_regs() { |                 if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { |                         ... |                 } else { |                         fpsimd_to_sve(current); |                         current-\u0026gt;thread.fp_type = FP_STATE_SVE; |                 } |         } | |         put_cpu_fpsimd_context(); | |         // Preempted; migrated from CPU 1 to CPU 0. |         // task-\u0026gt;fpsimd_cpu is still 0 |         // If per_cpu_ptr(\u0026amp;fpsimd_last_state, 0) is still task then: |         // - Stale HW state is reused (with SVE traps enabled) |         // - TIF_FOREIGN_FPSTATE is cleared |         // - A return to userspace skips HW state restore | }  Fix the case where the state is not live and TIF_FOREIGN_FPSTATE is set by calling fpsimd_flush_task_state() to detach from the saved CPU state. This ensures that a subsequent context switch will not reuse the stale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the new state to be reloaded from memory prior to a return to userspace.(CVE-2024-50275)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: vertexcom: mse102x: Fix possible double free of TX skb  The scope of the TX skb is wider than just mse102x_tx_frame_spi(), so in case the TX skb room needs to be expanded, we should free the the temporary skb instead of the original skb. Otherwise the original TX skb pointer would be freed again in mse102x_tx_work(), which leads to crashes:    Internal error: Oops: 0000000096000004 [#2] PREEMPT SMP   CPU: 0 PID: 712 Comm: kworker/0:1 Tainted: G      D            6.6.23   Hardware name: chargebyte Charge SOM DC-ONE (DT)   Workqueue: events mse102x_tx_work [mse102x]   pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)   pc : skb_release_data+0xb8/0x1d8   lr : skb_release_data+0x1ac/0x1d8   sp : ffff8000819a3cc0   x29: ffff8000819a3cc0 x28: ffff0000046daa60 x27: ffff0000057f2dc0   x26: ffff000005386c00 x25: 0000000000000002 x24: 00000000ffffffff   x23: 0000000000000000 x22: 0000000000000001 x21: ffff0000057f2e50   x20: 0000000000000006 x19: 0000000000000000 x18: ffff00003fdacfcc   x17: e69ad452d0c49def x16: 84a005feff870102 x15: 0000000000000000   x14: 000000000000024a x13: 0000000000000002 x12: 0000000000000000   x11: 0000000000000400 x10: 0000000000000930 x9 : ffff00003fd913e8   x8 : fffffc00001bc008   x7 : 0000000000000000 x6 : 0000000000000008   x5 : ffff00003fd91340 x4 : 0000000000000000 x3 : 0000000000000009   x2 : 00000000fffffffe x1 : 0000000000000000 x0 : 0000000000000000   Call trace:    skb_release_data+0xb8/0x1d8    kfree_skb_reason+0x48/0xb0    mse102x_tx_work+0x164/0x35c [mse102x]    process_one_work+0x138/0x260    worker_thread+0x32c/0x438    kthread+0x118/0x11c    ret_from_fork+0x10/0x20   Code: aa1303e0 97fffab6 72001c1f 54000141 (f9400660)(CVE-2024-50276)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp  ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_rsp().(CVE-2024-50283)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ksmbd: Fix the missing xa_store error check  xa_store() can fail, it return xa_err(-EINVAL) if the entry cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation failed, so check error for xa_store() to fix it.(CVE-2024-50284)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: av7110: fix a spectre vulnerability  As warned by smatch:  drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue \u0026apos;av7110-\u0026gt;ci_slot\u0026apos; [w] (local cap)  There is a spectre-related vulnerability at the code. Fix it.(CVE-2024-50289)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix missing locking causing hanging calls  If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local-\u0026gt;new_client_calls by rxrpc_disconnect_client_call() without a lock being held.  This may cause other calls on the list to disappear if a race occurs.  Fix this by taking the client_call_lock when removing a call from whatever list its -\u0026gt;wait_link happens to be on.(CVE-2024-50294)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: enetc: allocate vf_state during PF probes  In the previous implementation, vf_state is allocated memory only when VF is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before VF is enabled to configure the MAC address of VF. If this is the case, enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null pointer. The simplified error log is as follows.  root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89 [  173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [  173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy [  173.641973] lr : do_setlink+0x4a8/0xec8 [  173.732292] Call trace: [  173.734740]  enetc_pf_set_vf_mac+0x3c/0x80 [  173.738847]  __rtnl_newlink+0x530/0x89c [  173.742692]  rtnl_newlink+0x50/0x7c [  173.746189]  rtnetlink_rcv_msg+0x128/0x390 [  173.750298]  netlink_rcv_skb+0x60/0x130 [  173.754145]  rtnetlink_rcv+0x18/0x24 [  173.757731]  netlink_unicast+0x318/0x380 [  173.761665]  netlink_sendmsg+0x17c/0x3c8(CVE-2024-50298)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sctp: properly validate chunk size in sctp_sf_ootb()  A size validation fix similar to that in Commit 50619dbf8db7 (\u0026quot;sctp: add size validation when walking chunks\u0026quot;) is also required in sctp_sf_ootb() to address a crash reported by syzbot:    BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712   sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712   sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166   sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407   sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88   sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243   sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159   ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205   ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233(CVE-2024-50299)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mctp i2c: handle NULL header address  daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped.  saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol.(CVE-2024-53043)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  arm64: dts: imx8ulp: correct the flexspi compatible string  The flexspi on imx8ulp only has 16 LUTs, and imx8mm flexspi has 32 LUTs, so correct the compatible string here, otherwise will meet below error:  [    1.119072] ------------[ cut here ]------------ [    1.123926] WARNING: CPU: 0 PID: 1 at drivers/spi/spi-nxp-fspi.c:855 nxp_fspi_exec_op+0xb04/0xb64 [    1.133239] Modules linked in: [    1.136448] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc6-next-20240902-00001-g131bf9439dd9 #69 [    1.146821] Hardware name: NXP i.MX8ULP EVK (DT) [    1.151647] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [    1.158931] pc : nxp_fspi_exec_op+0xb04/0xb64 [    1.163496] lr : nxp_fspi_exec_op+0xa34/0xb64 [    1.168060] sp : ffff80008002b2a0 [    1.171526] x29: ffff80008002b2d0 x28: 0000000000000000 x27: 0000000000000000 [    1.179002] x26: ffff2eb645542580 x25: ffff800080610014 x24: ffff800080610000 [    1.186480] x23: ffff2eb645548080 x22: 0000000000000006 x21: ffff2eb6455425e0 [    1.193956] x20: 0000000000000000 x19: ffff80008002b5e0 x18: ffffffffffffffff [    1.201432] x17: ffff2eb644467508 x16: 0000000000000138 x15: 0000000000000002 [    1.208907] x14: 0000000000000000 x13: ffff2eb6400d8080 x12: 00000000ffffff00 [    1.216378] x11: 0000000000000000 x10: ffff2eb6400d8080 x9 : ffff2eb697adca80 [    1.223850] x8 : ffff2eb697ad3cc0 x7 : 0000000100000000 x6 : 0000000000000001 [    1.231324] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000007a6 [    1.238795] x2 : 0000000000000000 x1 : 00000000000001ce x0 : 00000000ffffff92 [    1.246267] Call trace: [    1.248824]  nxp_fspi_exec_op+0xb04/0xb64 [    1.253031]  spi_mem_exec_op+0x3a0/0x430 [    1.257139]  spi_nor_read_id+0x80/0xcc [    1.261065]  spi_nor_scan+0x1ec/0xf10 [    1.264901]  spi_nor_probe+0x108/0x2fc [    1.268828]  spi_mem_probe+0x6c/0xbc [    1.272574]  spi_probe+0x84/0xe4 [    1.275958]  really_probe+0xbc/0x29c [    1.279713]  __driver_probe_device+0x78/0x12c [    1.284277]  driver_probe_device+0xd8/0x15c [    1.288660]  __device_attach_driver+0xb8/0x134 [    1.293316]  bus_for_each_drv+0x88/0xe8 [    1.297337]  __device_attach+0xa0/0x190 [    1.301353]  device_initial_probe+0x14/0x20 [    1.305734]  bus_probe_device+0xac/0xb0 [    1.309752]  device_add+0x5d0/0x790 [    1.313408]  __spi_add_device+0x134/0x204 [    1.317606]  of_register_spi_device+0x3b4/0x590 [    1.322348]  spi_register_controller+0x47c/0x754 [    1.327181]  devm_spi_register_controller+0x4c/0xa4 [    1.332289]  nxp_fspi_probe+0x1cc/0x2b0 [    1.336307]  platform_probe+0x68/0xc4 [    1.340145]  really_probe+0xbc/0x29c [    1.343893]  __driver_probe_device+0x78/0x12c [    1.348457]  driver_probe_device+0xd8/0x15c [    1.352838]  __driver_attach+0x90/0x19c [    1.356857]  bus_for_each_dev+0x7c/0xdc [    1.360877]  driver_attach+0x24/0x30 [    1.364624]  bus_add_driver+0xe4/0x208 [    1.368552]  driver_register+0x5c/0x124 [    1.372573]  __platform_driver_register+0x28/0x34 [    1.377497]  nxp_fspi_driver_init+0x1c/0x28 [    1.381888]  do_one_initcall+0x80/0x1c8 [    1.385908]  kernel_init_freeable+0x1c4/0x28c [    1.390472]  kernel_init+0x20/0x1d8 [    1.394138]  ret_from_fork+0x10/0x20 [    1.397885] ---[ end trace 0000000000000000 ]--- [    1.407908] ------------[ cut here ]------------(CVE-2024-53046)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mptcp: init: protect sched with rcu_read_lock  Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT creates this splat when an MPTCP socket is created:    =============================   WARNING: suspicious RCU usage   6.12.0-rc2+ #11 Not tainted   -----------------------------   net/mptcp/sched.c:44 RCU-list traversed in non-reader section!!    other info that might help us debug this:    rcu_scheduler_active = 2, debug_locks = 1   no locks held by mptcp_connect/176.    stack backtrace:   CPU: 0 UID: 0 PID: 176 Comm: mptcp_connect Not tainted 6.12.0-rc2+ #11   Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011   Call Trace:    \u0026lt;TASK\u0026gt;    dump_stack_lvl (lib/dump_stack.c:123)    lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)    mptcp_sched_find (net/mptcp/sched.c:44 (discriminator 7))    mptcp_init_sock (net/mptcp/protocol.c:2867 (discriminator 1))    ? sock_init_data_uid (arch/x86/include/asm/atomic.h:28)    inet_create.part.0.constprop.0 (net/ipv4/af_inet.c:386)    ? __sock_create (include/linux/rcupdate.h:347 (discriminator 1))    __sock_create (net/socket.c:1576)    __sys_socket (net/socket.c:1671)    ? __pfx___sys_socket (net/socket.c:1712)    ? do_user_addr_fault (arch/x86/mm/fault.c:1419 (discriminator 1))    __x64_sys_socket (net/socket.c:1728)    do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1))    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)  That\u0026apos;s because when the socket is initialised, rcu_read_lock() is not used despite the explicit comment written above the declaration of mptcp_sched_find() in sched.c. Adding the missing lock/unlock avoids the warning.(CVE-2024-53047)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write  When io_uring starts a write, it\u0026apos;ll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write:  task:fio             state:D stack:0     pid:886   tgid:886   ppid:876 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_rwsem_wait+0x1e8/0x3f8  __percpu_down_read+0xe8/0x500  io_write+0xbb8/0xff8  io_issue_sqe+0x10c/0x1020  io_submit_sqes+0x614/0x2110  __arm64_sys_io_uring_enter+0x524/0x1038  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170 INFO: task fsfreeze:7364 blocked for more than 15 seconds.       Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963  with the attempting freezer stuck trying to grab the rwsem:  task:fsfreeze        state:D stack:0     pid:7364  tgid:7364  ppid:995 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_down_write+0x2b0/0x680  freeze_super+0x248/0x8a8  do_vfs_ioctl+0x149c/0x1b18  __arm64_sys_ioctl+0xd0/0x1a0  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170  Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn\u0026apos;t set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress.  Since freezing requires CAP_SYS_ADMIN in the first place, this isn\u0026apos;t something that can be triggered by a regular user.(CVE-2024-53052)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: fix 6 GHz scan construction  If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6 GHz scan construction will loop forever since the loop variable has type u8, which can never reach the number found when that\u0026apos;s bigger than 255, and is stored in a u32 variable. Also move it into the loops to have a smaller scope.  Using a u32 there is fine, we limit the number of APs in the scan list and each has a limit on the number of RNR entries due to the frame size. With a limit of 1000 scan results, a frame size upper bound of 4096 (really it\u0026apos;s more like ~2300) and a TBTT entry size of at least 11, we get an upper bound for the number of ~372k, well in the bounds of a u32.(CVE-2024-53055)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: s5p-jpeg: prevent buffer overflows  The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it.  While here, remove an unused word = 0 assignment.(CVE-2024-53061)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: dvbdev: prevent the risk of out of memory access  The dvbdev contains a static variable used to store dvb minors.  The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set, dvb_register_device() won\u0026apos;t check for boundaries, as it will rely that a previous call to dvb_register_adapter() would already be enforcing it.  On a similar way, dvb_device_open() uses the assumption that the register functions already did the needed checks.  This can be fragile if some device ends using different calls. This also generate warnings on static check analysers like Coverity.  So, add explicit guards to prevent potential risk of OOM issues.(CVE-2024-53063)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nfs: Fix KMSAN warning in decode_getfattr_attrs()  Fix the following KMSAN warning:  CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_generic+0x806/0xb00  nfs4_xdr_dec_getattr+0x1de/0x240  rpcauth_unwrap_resp_decode+0xab/0x100  rpcauth_unwrap_resp+0x95/0xc0  call_decode+0x4ff/0xb50  __rpc_execute+0x57b/0x19d0  rpc_execute+0x368/0x5e0  rpc_run_task+0xcfe/0xee0  nfs4_proc_getattr+0x5b5/0x990  __nfs_revalidate_inode+0x477/0xd00  nfs_access_get_cached+0x1021/0x1cc0  nfs_do_access+0x9f/0xae0  nfs_permission+0x1e4/0x8c0  inode_permission+0x356/0x6c0  link_path_walk+0x958/0x1330  path_lookupat+0xce/0x6b0  filename_lookup+0x23e/0x770  vfs_statx+0xe7/0x970  vfs_fstatat+0x1f2/0x2c0  __se_sys_newfstatat+0x67/0x880  __x64_sys_newfstatat+0xbd/0x120  x64_sys_call+0x1826/0x3cf0  do_syscall_64+0xd0/0x1b0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr-\u0026gt;mdsthreshold is not initialized.  Fix the issue by initializing fattr-\u0026gt;mdsthreshold to NULL in nfs_fattr_init().(CVE-2024-53066)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()  If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop of iio_gts_build_avail_scale_table(), the err_free_out will fail to call kfree() each time when i is reduced to 0, so all the per_time_scales[0] and per_time_gains[0] will not be freed, which will cause memory leaks.  Fix it by checking if i \u0026gt;= 0.(CVE-2024-53076)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier  If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and txbuf_len are uninitialized. This commit stops to print uninitialized value and misleading/false data.(CVE-2024-53083)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  tpm: Lock TPM chip in tpm_pm_suspend() first  Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour.  Aadress this by locking the TPM chip before checking any chip-\u0026gt;flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved.(CVE-2024-53085)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  LoongArch: KVM: Mark hrtimer to expire in hard interrupt context  Like commit 2c0d278f3293f (\u0026quot;KVM: LAPIC: Mark hrtimer to expire in hard interrupt context\u0026quot;) and commit 9090825fa9974 (\u0026quot;KVM: arm/arm64: Let the timer expire in hardirq context on RT\u0026quot;), On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft interrupt expiry mode by default. Then the timers are canceled from an preempt-notifier which is invoked with disabled preemption which is not allowed on PREEMPT_RT.  The timer callback is short so in could be invoked in hard-IRQ context. So let the timer expire on hard-IRQ context even on -RT.  This fix a \u0026quot;scheduling while atomic\u0026quot; bug for PREEMPT_RT enabled kernels:   BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002  Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns  CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G        W          6.12.0-rc2+ #1774  Tainted: [W]=WARN  Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022  Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000          90000001167475a0 0000000000000000 90000001167475a8 9000000005644830          90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001          0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140          00000000000003fe 0000000000000001 000000000000000d 0000000000000003          0000000000000030 00000000000003f3 000000000790c000 9000000116747830          90000000057ef000 0000000000000000 9000000005644830 0000000000000004          0000000000000000 90000000057f4b58 0000000000000001 9000000116747868          900000000451b600 9000000005644830 9000000003a13998 0000000010000020          00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d          ...  Call Trace:  [\u0026lt;9000000003a13998\u0026gt;] show_stack+0x38/0x180  [\u0026lt;9000000004e3ea34\u0026gt;] dump_stack_lvl+0x84/0xc0  [\u0026lt;9000000003a71708\u0026gt;] __schedule_bug+0x48/0x60  [\u0026lt;9000000004e45734\u0026gt;] __schedule+0x1114/0x1660  [\u0026lt;9000000004e46040\u0026gt;] schedule_rtlock+0x20/0x60  [\u0026lt;9000000004e4e330\u0026gt;] rtlock_slowlock_locked+0x3f0/0x10a0  [\u0026lt;9000000004e4f038\u0026gt;] rt_spin_lock+0x58/0x80  [\u0026lt;9000000003b02d68\u0026gt;] hrtimer_cancel_wait_running+0x68/0xc0  [\u0026lt;9000000003b02e30\u0026gt;] hrtimer_cancel+0x70/0x80  [\u0026lt;ffff80000235eb70\u0026gt;] kvm_restore_timer+0x50/0x1a0 [kvm]  [\u0026lt;ffff8000023616c8\u0026gt;] kvm_arch_vcpu_load+0x68/0x2a0 [kvm]  [\u0026lt;ffff80000234c2d4\u0026gt;] kvm_sched_in+0x34/0x60 [kvm]  [\u0026lt;9000000003a749a0\u0026gt;] finish_task_switch.isra.0+0x140/0x2e0  [\u0026lt;9000000004e44a70\u0026gt;] __schedule+0x450/0x1660  [\u0026lt;9000000004e45cb0\u0026gt;] schedule+0x30/0x180  [\u0026lt;ffff800002354c70\u0026gt;] kvm_vcpu_block+0x70/0x120 [kvm]  [\u0026lt;ffff800002354d80\u0026gt;] kvm_vcpu_halt+0x60/0x3e0 [kvm]  [\u0026lt;ffff80000235b194\u0026gt;] kvm_handle_gspr+0x3f4/0x4e0 [kvm]  [\u0026lt;ffff80000235f548\u0026gt;] kvm_handle_exit+0x1c8/0x260 [kvm](CVE-2024-53089)","status":"published","published":"2024-11-29T11:07:58Z","modified":"2026-08-18T01:18:40.268895496Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2493","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: missing check virtio\r\n\r\nTwo missing check in virtio_net_hdr_to_skb() allowed syzbot\nto crash kernels again\r\n\r\n1. After the skb_segment function the buffer may become non-linear\n(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere\nthe __skb_linearize function will not be executed, then the buffer will\nremain non-linear. Then the condition (offset \u0026gt;= skb_headlen(skb))\nbecomes true, which causes WARN_ON_ONCE in skb_checksum_help.\r\n\r\n2. The struct sk_buff and struct virtio_net_hdr members must be\nmathematically related.\n(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) may be 0 if division is without remainder.\r\n\r\noffset+2 (4191) \u0026gt; skb_headlen() (1116)\nWARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nModules linked in:\nCPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nRIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nCode: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 \u0026lt;0f\u0026gt; 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef\nRSP: 0018:ffffc90003a9f338 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209\nRDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001\nRBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c\nR13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d\nFS:  0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777\n ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584\n ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]\n __ip_finish_output net/ipv4/ip_output.c:308 [inline]\n __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433\n dst_output include/net/dst.h:451 [inline]\n ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]\n sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3545 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x257/0x380 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\n __sys_sendto+0x255/0x340 net/socket.c:2190\n __do_sys_sendto net/socket.c:2202 [inline]\n __se_sys_sendto net/socket.c:2198 [inline]\n __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller(CVE-2024-43817)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: flowtable: initialise extack before use\r\n\r\nFix missing initialisation of extack in flow offload.(CVE-2024-45018)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/aux: Fix AUX buffer serialization\r\n\r\nOle reported that event-\u0026gt;mmap_mutex is strictly insufficient to\nserialize the AUX buffer, add a per RB mutex to fully serialize it.\r\n\r\nNote that in the lock order comment the perf_event::mmap_mutex order\nwas already wrong, that is, it nesting under mmap_lock is not new with\nthis patch.(CVE-2024-46713)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mm: call the security_mmap_file() LSM hook in remap_file_pages()  The remap_file_pages syscall handler calls do_mmap() directly, which doesn\u0026apos;t contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux.  So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux.  The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1].  The PoC:  $ cat \u0026gt; test.c  int main(void) {  size_t pagesz = sysconf(_SC_PAGE_SIZE);  int mfd = syscall(SYS_memfd_create, \u0026quot;test\u0026quot;, 0);  const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,   MAP_SHARED, mfd, 0);  unsigned int old = syscall(SYS_personality, 0xffffffff);  syscall(SYS_personality, READ_IMPLIES_EXEC | old);  syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);  syscall(SYS_personality, old);  // show the RWX page exists even if W^X policy is enforced  int fd = open(\u0026quot;/proc/self/maps\u0026quot;, O_RDONLY);  unsigned char buf2[1024];  while (1) {   int ret = read(fd, buf2, 1024);   if (ret \u0026lt;= 0) break;   write(1, buf2, ret);  }  close(fd); }  $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)  [PM: subject line tweaks](CVE-2024-47745)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition  In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to \u0026amp;prev(dev)-\u0026gt;timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:  CPU0                                    CPU1                        |  ether3_ledoff ether3_remove         |   free_netdev(dev);   |   put_devic           |   kfree(dev);         |  |  ether3_outw(priv(dev)-\u0026gt;regs.config2 |= CFG2_CTRLO, REG_CONFIG2);                       | // use dev  Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.(CVE-2024-47747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/cxgb4: Added NULL check for lookup_atid  The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-47749)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Initialize denominators\u0026apos; default to 1  [WHAT \u0026amp; HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0.  This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.(CVE-2024-49899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: avoid NULL pointer dereference  iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn\u0026apos;t either.(CVE-2024-49929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: prevent nf_skb_duplicated corruption  syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].  Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.  [1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316  caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace:  \u0026lt;TASK\u0026gt;   __dump_stack lib/dump_stack.c:93 [inline]   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119   check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49   nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87   nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30   expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]   nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288   nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23   nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]   nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626   nf_hook+0x2c4/0x450 include/linux/netfilter.h:269   NF_HOOK_COND include/linux/netfilter.h:302 [inline]   ip_output+0x185/0x230 net/ipv4/ip_output.c:433   ip_local_out net/ipv4/ip_output.c:129 [inline]   ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495   udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981   udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269   sock_sendmsg_nosec net/socket.c:730 [inline]   __sock_sendmsg+0x1a6/0x270 net/socket.c:745   ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597   ___sys_sendmsg net/socket.c:2651 [inline]   __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737   __do_sys_sendmmsg net/socket.c:2766 [inline]   __se_sys_sendmmsg net/socket.c:2763 [inline]   __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68  \u0026lt;/TASK\u0026gt;(CVE-2024-49952)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: br_netfilter: fix panic with metadata_dst skb  Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit.  It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded  When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata-\u0026gt;dst.dev is NULL.  Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there\u0026apos;s a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.  The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst-\u0026gt;dev, thus the crash.  This case was never supported in the first place, so drop the packet instead.  PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [  176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [  176.292101] Mem abort info: [  176.292184]   ESR = 0x0000000096000004 [  176.292322]   EC = 0x25: DABT (current EL), IL = 32 bits [  176.292530]   SET = 0, FnV = 0 [  176.292709]   EA = 0, S1PTW = 0 [  176.292862]   FSC = 0x04: level 0 translation fault [  176.293013] Data abort info: [  176.293104]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [  176.293488]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [  176.293787]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [  176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [  176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [  176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [  176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [  176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [  176.296314] Hardware name: linux,dummy-virt (DT) [  176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [  176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [  176.297636] sp : ffff800080003630 [  176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [  176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [  176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [  176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [  176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [  176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [  176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [  176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [  176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [  176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [  176.300889] Call trace: [  176.301123]  br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.301411]  br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [  176.301703]  nf_hook_slow+0x48/0x124 [  176.302060]  br_forward_finish+0xc8/0xe8 [bridge] [  176.302371]  br_nf_hook_thresh+0x124/0x134 [br_netfilter] [  176.302605]  br_nf_forward_finish+0x118/0x22c [br_netfilter] [  176.302824]  br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [  176.303136]  br_nf_forward+0x2b8/0x4e0 [br_netfilter] [  176.303359]  nf_hook_slow+0x48/0x124 [  176.303 ---truncated---(CVE-2024-50045)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/rtrs-srv: Avoid null pointer deref during path establishment  For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.  So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.(CVE-2024-50062)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow  Syzkaller reported this splat:    ==================================================================   BUG: KASAN: slab-use-after-free in mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881   Read of size 4 at addr ffff8880569ac858 by task syz.1.2799/14662    CPU: 0 UID: 0 PID: 14662 Comm: syz.1.2799 Not tainted 6.12.0-rc2-syzkaller-00307-g36c254515dc6 #0   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014   Call Trace:    \u0026lt;TASK\u0026gt;    __dump_stack lib/dump_stack.c:94 [inline]    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120    print_address_description mm/kasan/report.c:377 [inline]    print_report+0xc3/0x620 mm/kasan/report.c:488    kasan_report+0xd9/0x110 mm/kasan/report.c:601    mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881    mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:914 [inline]    mptcp_nl_remove_id_zero_address+0x305/0x4a0 net/mptcp/pm_netlink.c:1572    mptcp_pm_nl_del_addr_doit+0x5c9/0x770 net/mptcp/pm_netlink.c:1603    genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]    genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210    netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2551    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219    netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]    netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1357    netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901    sock_sendmsg_nosec net/socket.c:729 [inline]    __sock_sendmsg net/socket.c:744 [inline]    ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2607    ___sys_sendmsg+0x135/0x1e0 net/socket.c:2661    __sys_sendmsg+0x117/0x1f0 net/socket.c:2690    do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]    __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386    do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411    entry_SYSENTER_compat_after_hwframe+0x84/0x8e   RIP: 0023:0xf7fe4579   Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 \u0026lt;5d\u0026gt; 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00   RSP: 002b:00000000f574556c EFLAGS: 00000296 ORIG_RAX: 0000000000000172   RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000020000140   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000   RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000   R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000    \u0026lt;/TASK\u0026gt;    Allocated by task 5387:    kasan_save_stack+0x33/0x60 mm/kasan/common.c:47    kasan_save_track+0x14/0x30 mm/kasan/common.c:68    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]    __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394    kmalloc_noprof include/linux/slab.h:878 [inline]    kzalloc_noprof include/linux/slab.h:1014 [inline]    subflow_create_ctx+0x87/0x2a0 net/mptcp/subflow.c:1803    subflow_ulp_init+0xc3/0x4d0 net/mptcp/subflow.c:1956    __tcp_set_ulp net/ipv4/tcp_ulp.c:146 [inline]    tcp_set_ulp+0x326/0x7f0 net/ipv4/tcp_ulp.c:167    mptcp_subflow_create_socket+0x4ae/0x10a0 net/mptcp/subflow.c:1764    __mptcp_subflow_connect+0x3cc/0x1490 net/mptcp/subflow.c:1592    mptcp_pm_create_subflow_or_signal_addr+0xbda/0x23a0 net/mptcp/pm_netlink.c:642    mptcp_pm_nl_fully_established net/mptcp/pm_netlink.c:650 [inline]    mptcp_pm_nl_work+0x3a1/0x4f0 net/mptcp/pm_netlink.c:943    mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2777    process_one_work+0x958/0x1b30 kernel/workqueue.c:3229    process_scheduled_works kernel/workqueue.c:3310 [inline]    worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391    kthread+0x2c1/0x3a0 kernel/kthread.c:389    ret_from_fork+0x45/0x80 arch/x86/ke ---truncated---(CVE-2024-50085)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  unicode: Don\u0026apos;t special case ignorable code points  We don\u0026apos;t need to handle them separately. Instead, just let them decompose/casefold to themselves.(CVE-2024-50089)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context  PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services.  The issue arises because the PRMT is finding a block of type EFI_CONVENTIONAL_MEMORY, which is not appropriate for runtime services as described in Section 2.2.2 (Runtime Services) of the UEFI Specification [1]. Since the PRM handler is a type of runtime service, this causes an exception when the PRM handler is called.      [Firmware Bug]: Unable to handle paging request in EFI runtime service     WARNING: CPU: 22 PID: 4330 at drivers/firmware/efi/runtime-wrappers.c:341         __efi_queue_work+0x11c/0x170     Call trace:  Let PRMT find a block with EFI_MEMORY_RUNTIME for PRM handler and PRM context.  If no suitable block is found, a warning message will be printed, but the procedure continues to manage the next PRM handler.  However, if the PRM handler is actually called without proper allocation, it would result in a failure during error handling.  By using the correct memory types for runtime services, ensure that the PRM handler and the context are properly mapped in the virtual address space during runtime, preventing the paging request error.  The issue is really that only memory that has been remapped for runtime by the firmware can be used by the PRM handler, and so the region needs to have the EFI_MEMORY_RUNTIME attribute.  [ rjw: Subject and changelog edits ](CVE-2024-50141)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  udf: fix uninit-value use in udf_get_fileshortad  Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].  [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000(CVE-2024-50143)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ceph: remove the incorrect Fw reference check when dirtying pages  When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won\u0026apos;t hold the Fw caps and there is case will it get the Fw reference.(CVE-2024-50179)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  fbdev: sisfb: Fix strbuf array overflow  The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1. The strbuf1 array contains digit characters and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, \u0026quot;%ux%ux8\u0026quot;, xres, yres); more than 16 bytes will be written to strbuf. It is suggested to increase the size of the strbuf array to 24.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50180)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  irqchip/gic-v4: Don\u0026apos;t allow a VMOVP on a dying VPE  Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/.  Plug the race by checking the value of vmapp_count, which tracks whether the VPE is mapped ot not, and returning an error in this case.  This involves making vmapp_count common to both GICv4.1 and its v4.0 ancestor.(CVE-2024-50192)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  posix-clock: Fix missing timespec64 check in pc_clock_settime()  As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct\u0026apos;s tv_sec and tv_nsec range before calling ptp-\u0026gt;info-\u0026gt;settime64().  As the man manual of clock_settime() said, if tp.tv_sec is negative or tp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL, which include dynamic clocks which handles PTP clock, and the condition is consistent with timespec64_valid(). As Thomas suggested, timespec64_valid() only check the timespec is valid, but not ensure that the time is in a valid range, so check it ahead using timespec64_valid_strict() in pc_clock_settime() and return -EINVAL if not valid.  There are some drivers that use tp-\u0026gt;tv_sec and tp-\u0026gt;tv_nsec directly to write registers without validity checks and assume that the higher layer has checked it, which is dangerous and will benefit from this, such as hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(), and some drivers can remove the checks of itself.(CVE-2024-50195)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: propagate directory read errors from nilfs_find_entry()  Syzbot reported that a task hang occurs in vcs_open() during a fuzzing test for nilfs2.  The root cause of this problem is that in nilfs_find_entry(), which searches for directory entries, ignores errors when loading a directory page/folio via nilfs_get_folio() fails.  If the filesystem images is corrupted, and the i_size of the directory inode is large, and the directory page/folio is successfully read but fails the sanity check, for example when it is zero-filled, nilfs_check_folio() may continue to spit out error messages in bursts.  Fix this issue by propagating the error to the callers when loading a page/folio fails in nilfs_find_entry().  The current interface of nilfs_find_entry() and its callers is outdated and cannot propagate error codes such as -EIO and -ENOMEM returned via nilfs_find_entry(), so fix it together.(CVE-2024-50202)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()  The step variable is initialized to zero. It is changed in the loop, but if it\u0026apos;s not changed it will remain zero. Add a variable check before the division.  The observed behavior was introduced by commit 826b5de90c0b (\u0026quot;ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size\u0026quot;), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50205)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix potential deadlock with newly created symlinks  Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among the reader/writer semaphore nilfs-\u0026gt;ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the fs_reclaim pseudo lock.  This is because after commit 21fc61c73c39 (\u0026quot;don\u0026apos;t put symlink bodies in pagecache into highmem\u0026quot;), the gfp flags of the page cache for symbolic links are overwritten to GFP_KERNEL via inode_nohighmem().  This is not a problem for symlinks read from the backing device, because the __GFP_FS flag is dropped after inode_nohighmem() is called.  However, when a new symlink is created with nilfs_symlink(), the gfp flags remain overwritten to GFP_KERNEL.  Then, memory allocation called from page_symlink() etc.  triggers memory reclamation including the FS layer, which may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can cause a deadlock if they are called while nilfs-\u0026gt;ns_segctor_sem is held:  Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs_new_inode() and __nilfs_read_inode() do, as a workaround until we adopt nofs allocation scope consistently or improve the locking constraints.(CVE-2024-50229)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix kernel bug due to missing clearing of checked flag  Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug.  This was found to be because the \u0026quot;checked\u0026quot; flag of a page/folio was not cleared when it was discarded by nilfs2\u0026apos;s own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded.  So, fix that.  This was necessary when the use of nilfs2\u0026apos;s own page discard routine was applied to more than just metadata files.(CVE-2024-50230)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Initialize struct nfsd4_copy earlier  Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.(CVE-2024-50241)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ntfs3: Add bounds checking to mi_enum_attr()  Added bounds checking to make sure that every attr don\u0026apos;t stray beyond valid memory region.(CVE-2024-50248)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: Fix out-of-bounds write in trie_get_next_key()  trie_get_next_key() allocates a node stack with size trie-\u0026gt;max_prefixlen, while it writes (trie-\u0026gt;max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.(CVE-2024-50262)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()  Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():  [   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry [   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [   57.331328] Call Trace: [   57.331477]  \u0026lt;TASK\u0026gt; [...] [   57.333511]  ? do_user_addr_fault+0x3e5/0x740 [   57.333778]  ? exc_page_fault+0x70/0x170 [   57.334016]  ? asm_exc_page_fault+0x2b/0x30 [   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0 [   57.335164]  ocfs2_xa_set+0x704/0xcf0 [   57.335381]  ? _raw_spin_unlock+0x1a/0x40 [   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20 [   57.335915]  ? trace_preempt_on+0x1e/0x70 [   57.336153]  ? start_this_handle+0x16c/0x500 [   57.336410]  ? preempt_count_sub+0x50/0x80 [   57.336656]  ? _raw_read_unlock+0x20/0x40 [   57.336906]  ? start_this_handle+0x16c/0x500 [   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0 [   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0 [   57.337706]  ? ocfs2_start_trans+0x13d/0x290 [   57.337971]  ocfs2_xattr_set+0xb13/0xfb0 [   57.338207]  ? dput+0x46/0x1c0 [   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30 [   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30 [   57.338948]  __vfs_removexattr+0x92/0xc0 [   57.339182]  __vfs_removexattr_locked+0xd5/0x190 [   57.339456]  ? preempt_count_sub+0x50/0x80 [   57.339705]  vfs_removexattr+0x5f/0x100 [...]  Reproducer uses faultinject facility to fail ocfs2_xa_remove() -\u0026gt; ocfs2_xa_value_truncate() with -ENOMEM.  In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following \u0026apos;rc\u0026apos; check is wrong and execution flow do \u0026apos;ocfs2_xa_remove_entry(loc);\u0026apos; twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to \u0026apos;out\u0026apos;.  Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy.(CVE-2024-50265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  usb: musb: sunxi: Fix accessing an released usb phy  Commit 6ed05c68cbca (\u0026quot;usb: musb: sunxi: Explicitly release USB PHY on exit\u0026quot;) will cause that usb phy @glue-\u0026gt;xceiv is accessed after released.  1) register platform driver @sunxi_musb_driver // get the usb phy @glue-\u0026gt;xceiv sunxi_musb_probe() -\u0026gt; devm_usb_get_phy().  2) register and unregister platform driver @musb_driver musb_probe() -\u0026gt; sunxi_musb_init() use the phy here //the phy is released here musb_remove() -\u0026gt; sunxi_musb_exit() -\u0026gt; devm_usb_put_phy()  3) register @musb_driver again musb_probe() -\u0026gt; sunxi_musb_init() use the phy here but the phy has been released at 2). ...  Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().(CVE-2024-50269)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: reinitialize delayed ref list after deleting it from the list  At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0026apos;s ref_add_list using list_del(), which leaves the ref\u0026apos;s add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively.  If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref\u0026apos;s add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise.  So fix this by deleting from the list with list_del_init() instead.(CVE-2024-50273)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: av7110: fix a spectre vulnerability  As warned by smatch:  drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue \u0026apos;av7110-\u0026gt;ci_slot\u0026apos; [w] (local cap)  There is a spectre-related vulnerability at the code. Fix it.(CVE-2024-50289)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  security/keys: fix slab-out-of-bounds in key_task_permission  KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 security/keys/permission.c:54 Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362  CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 Call Trace:  __dump_stack lib/dump_stack.c:82 [inline]  dump_stack+0x107/0x167 lib/dump_stack.c:123  print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400  __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560  kasan_report+0x3a/0x50 mm/kasan/report.c:585  __kuid_val include/linux/uidgid.h:36 [inline]  uid_eq include/linux/uidgid.h:63 [inline]  key_task_permission+0x394/0x410 security/keys/permission.c:54  search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793  This issue was also reported by syzbot.  It can be reproduced by following these steps(more details [1]): 1. Obtain more than 32 inputs that have similar hashes, which ends with the    pattern \u0026apos;0xxxxxxxe6\u0026apos;. 2. Reboot and add the keys obtained in step 1.  The reproducer demonstrates how this issue happened: 1. In the search_nested_keyrings function, when it iterates through the    slots in a node(below tag ascend_to_node), if the slot pointer is meta    and node-\u0026gt;back_pointer != NULL(it means a root), it will proceed to    descend_to_node. However, there is an exception. If node is the root,    and one of the slots points to a shortcut, it will be treated as a    keyring. 2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function.    However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as    ASSOC_ARRAY_PTR_SUBTYPE_MASK. 3. When 32 keys with the similar hashes are added to the tree, the ROOT    has keys with hashes that are not similar (e.g. slot 0) and it splits    NODE A without using a shortcut. When NODE A is filled with keys that    all hashes are xxe6, the keys are similar, NODE A will split with a    shortcut. Finally, it forms the tree as shown below, where slot 6 points    to a shortcut.                        NODE A               +------\u0026gt;+---+       ROOT    |       | 0 | xxe6       +---+   |       +---+  xxxx | 0 | shortcut  :   : xxe6       +---+   |       +---+  xxe6 :   :   |       |   | xxe6       +---+   |       +---+       | 6 |---+       :   : xxe6       +---+           +---+  xxe6 :   :           | f | xxe6       +---+           +---+  xxe6 | f |       +---+  4. As mentioned above, If a slot(slot 6) of the root points to a shortcut,    it may be mistakenly transferred to a key*, leading to a read    out-of-bounds read.  To fix this issue, one should jump to descend_to_node if the ptr is a shortcut, regardless of whether the node is root or not.  [1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/  [jarkko: tweaked the commit message a bit to have an appropriate closes  tag.](CVE-2024-50301)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write  When io_uring starts a write, it\u0026apos;ll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write:  task:fio             state:D stack:0     pid:886   tgid:886   ppid:876 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_rwsem_wait+0x1e8/0x3f8  __percpu_down_read+0xe8/0x500  io_write+0xbb8/0xff8  io_issue_sqe+0x10c/0x1020  io_submit_sqes+0x614/0x2110  __arm64_sys_io_uring_enter+0x524/0x1038  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170 INFO: task fsfreeze:7364 blocked for more than 15 seconds.       Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963  with the attempting freezer stuck trying to grab the rwsem:  task:fsfreeze        state:D stack:0     pid:7364  tgid:7364  ppid:995 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_down_write+0x2b0/0x680  freeze_super+0x248/0x8a8  do_vfs_ioctl+0x149c/0x1b18  __arm64_sys_ioctl+0xd0/0x1a0  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170  Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn\u0026apos;t set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress.  Since freezing requires CAP_SYS_ADMIN in the first place, this isn\u0026apos;t something that can be triggered by a regular user.(CVE-2024-53052)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: s5p-jpeg: prevent buffer overflows  The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it.  While here, remove an unused word = 0 assignment.(CVE-2024-53061)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nfs: Fix KMSAN warning in decode_getfattr_attrs()  Fix the following KMSAN warning:  CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_generic+0x806/0xb00  nfs4_xdr_dec_getattr+0x1de/0x240  rpcauth_unwrap_resp_decode+0xab/0x100  rpcauth_unwrap_resp+0x95/0xc0  call_decode+0x4ff/0xb50  __rpc_execute+0x57b/0x19d0  rpc_execute+0x368/0x5e0  rpc_run_task+0xcfe/0xee0  nfs4_proc_getattr+0x5b5/0x990  __nfs_revalidate_inode+0x477/0xd00  nfs_access_get_cached+0x1021/0x1cc0  nfs_do_access+0x9f/0xae0  nfs_permission+0x1e4/0x8c0  inode_permission+0x356/0x6c0  link_path_walk+0x958/0x1330  path_lookupat+0xce/0x6b0  filename_lookup+0x23e/0x770  vfs_statx+0xe7/0x970  vfs_fstatat+0x1f2/0x2c0  __se_sys_newfstatat+0x67/0x880  __x64_sys_newfstatat+0xbd/0x120  x64_sys_call+0x1826/0x3cf0  do_syscall_64+0xd0/0x1b0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr-\u0026gt;mdsthreshold is not initialized.  Fix the issue by initializing fattr-\u0026gt;mdsthreshold to NULL in nfs_fattr_init().(CVE-2024-53066)","status":"published","published":"2024-11-29T11:07:58Z","modified":"2026-08-18T01:18:40.249096942Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2494","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbonding: stop the device in bond_setup_by_slave()\r\n\r\nCommit 9eed321cde22 (\u0026quot;net: lapbether: only support ethernet devices\u0026quot;)\nhas been able to keep syzbot away from net/lapb, until today.\r\n\r\nIn the following splat [1], the issue is that a lapbether device has\nbeen created on a bonding device without members. Then adding a non\nARPHRD_ETHER member forced the bonding master to change its type.\r\n\r\nThe fix is to make sure we call dev_close() in bond_setup_by_slave()\nso that the potential linked lapbether devices (or any other devices\nhaving assumptions on the physical device) are removed.\r\n\r\nA similar bug has been addressed in commit 40baec225765\n(\u0026quot;bonding: fix panic on non-ARPHRD_ETHER enslave failure\u0026quot;)\r\n\r\n[1]\nskbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0\nkernel BUG at net/core/skbuff.c:192 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : skb_panic net/core/skbuff.c:188 [inline]\npc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nlr : skb_panic net/core/skbuff.c:188 [inline]\nlr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nsp : ffff800096a06aa0\nx29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000\nx26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea\nx23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140\nx20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100\nx17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001\nx14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00\nx8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c\nx2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086\nCall trace:\nskb_panic net/core/skbuff.c:188 [inline]\nskb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nskb_push+0xf0/0x108 net/core/skbuff.c:2446\nip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384\ndev_hard_header include/linux/netdevice.h:3136 [inline]\nlapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257\nlapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447\nlapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149\nlapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251\n__lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326\nlapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nlapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nbond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332\nbond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539\ndev_ifsioc+0x754/0x9ac\ndev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786\nsock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217\nsock_ioctl+0x4e8/0x834 net/socket.c:1322\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_\n---truncated---(CVE-2023-52784)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: missing check virtio\r\n\r\nTwo missing check in virtio_net_hdr_to_skb() allowed syzbot\nto crash kernels again\r\n\r\n1. After the skb_segment function the buffer may become non-linear\n(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere\nthe __skb_linearize function will not be executed, then the buffer will\nremain non-linear. Then the condition (offset \u0026gt;= skb_headlen(skb))\nbecomes true, which causes WARN_ON_ONCE in skb_checksum_help.\r\n\r\n2. The struct sk_buff and struct virtio_net_hdr members must be\nmathematically related.\n(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) may be 0 if division is without remainder.\r\n\r\noffset+2 (4191) \u0026gt; skb_headlen() (1116)\nWARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nModules linked in:\nCPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nRIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nCode: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 \u0026lt;0f\u0026gt; 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef\nRSP: 0018:ffffc90003a9f338 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209\nRDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001\nRBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c\nR13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d\nFS:  0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777\n ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584\n ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]\n __ip_finish_output net/ipv4/ip_output.c:308 [inline]\n __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433\n dst_output include/net/dst.h:451 [inline]\n ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]\n sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3545 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x257/0x380 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\n __sys_sendto+0x255/0x340 net/socket.c:2190\n __do_sys_sendto net/socket.c:2202 [inline]\n __se_sys_sendto net/socket.c:2198 [inline]\n __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller(CVE-2024-43817)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: flowtable: initialise extack before use\r\n\r\nFix missing initialisation of extack in flow offload.(CVE-2024-45018)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/aux: Fix AUX buffer serialization\r\n\r\nOle reported that event-\u0026gt;mmap_mutex is strictly insufficient to\nserialize the AUX buffer, add a per RB mutex to fully serialize it.\r\n\r\nNote that in the lock order comment the perf_event::mmap_mutex order\nwas already wrong, that is, it nesting under mmap_lock is not new with\nthis patch.(CVE-2024-46713)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mm: call the security_mmap_file() LSM hook in remap_file_pages()  The remap_file_pages syscall handler calls do_mmap() directly, which doesn\u0026apos;t contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux.  So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux.  The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1].  The PoC:  $ cat \u0026gt; test.c  int main(void) {  size_t pagesz = sysconf(_SC_PAGE_SIZE);  int mfd = syscall(SYS_memfd_create, \u0026quot;test\u0026quot;, 0);  const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,   MAP_SHARED, mfd, 0);  unsigned int old = syscall(SYS_personality, 0xffffffff);  syscall(SYS_personality, READ_IMPLIES_EXEC | old);  syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);  syscall(SYS_personality, old);  // show the RWX page exists even if W^X policy is enforced  int fd = open(\u0026quot;/proc/self/maps\u0026quot;, O_RDONLY);  unsigned char buf2[1024];  while (1) {   int ret = read(fd, buf2, 1024);   if (ret \u0026lt;= 0) break;   write(1, buf2, ret);  }  close(fd); }  $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)  [PM: subject line tweaks](CVE-2024-47745)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition  In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to \u0026amp;prev(dev)-\u0026gt;timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:  CPU0                                    CPU1                        |  ether3_ledoff ether3_remove         |   free_netdev(dev);   |   put_devic           |   kfree(dev);         |  |  ether3_outw(priv(dev)-\u0026gt;regs.config2 |= CFG2_CTRLO, REG_CONFIG2);                       | // use dev  Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.(CVE-2024-47747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/cxgb4: Added NULL check for lookup_atid  The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-47749)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Initialize denominators\u0026apos; default to 1  [WHAT \u0026amp; HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0.  This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.(CVE-2024-49899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: avoid NULL pointer dereference  iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn\u0026apos;t either.(CVE-2024-49929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: prevent nf_skb_duplicated corruption  syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].  Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.  [1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316  caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace:  \u0026lt;TASK\u0026gt;   __dump_stack lib/dump_stack.c:93 [inline]   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119   check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49   nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87   nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30   expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]   nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288   nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23   nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]   nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626   nf_hook+0x2c4/0x450 include/linux/netfilter.h:269   NF_HOOK_COND include/linux/netfilter.h:302 [inline]   ip_output+0x185/0x230 net/ipv4/ip_output.c:433   ip_local_out net/ipv4/ip_output.c:129 [inline]   ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495   udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981   udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269   sock_sendmsg_nosec net/socket.c:730 [inline]   __sock_sendmsg+0x1a6/0x270 net/socket.c:745   ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597   ___sys_sendmsg net/socket.c:2651 [inline]   __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737   __do_sys_sendmmsg net/socket.c:2766 [inline]   __se_sys_sendmmsg net/socket.c:2763 [inline]   __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68  \u0026lt;/TASK\u0026gt;(CVE-2024-49952)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  netfilter: br_netfilter: fix panic with metadata_dst skb  Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit.  It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded  When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata-\u0026gt;dst.dev is NULL.  Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there\u0026apos;s a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.  The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst-\u0026gt;dev, thus the crash.  This case was never supported in the first place, so drop the packet instead.  PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [  176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [  176.292101] Mem abort info: [  176.292184]   ESR = 0x0000000096000004 [  176.292322]   EC = 0x25: DABT (current EL), IL = 32 bits [  176.292530]   SET = 0, FnV = 0 [  176.292709]   EA = 0, S1PTW = 0 [  176.292862]   FSC = 0x04: level 0 translation fault [  176.293013] Data abort info: [  176.293104]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [  176.293488]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [  176.293787]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [  176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [  176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [  176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [  176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [  176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [  176.296314] Hardware name: linux,dummy-virt (DT) [  176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [  176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [  176.297636] sp : ffff800080003630 [  176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [  176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [  176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [  176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [  176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [  176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [  176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [  176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [  176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [  176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [  176.300889] Call trace: [  176.301123]  br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [  176.301411]  br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [  176.301703]  nf_hook_slow+0x48/0x124 [  176.302060]  br_forward_finish+0xc8/0xe8 [bridge] [  176.302371]  br_nf_hook_thresh+0x124/0x134 [br_netfilter] [  176.302605]  br_nf_forward_finish+0x118/0x22c [br_netfilter] [  176.302824]  br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [  176.303136]  br_nf_forward+0x2b8/0x4e0 [br_netfilter] [  176.303359]  nf_hook_slow+0x48/0x124 [  176.303 ---truncated---(CVE-2024-50045)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/rtrs-srv: Avoid null pointer deref during path establishment  For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.  So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.(CVE-2024-50062)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow  Syzkaller reported this splat:    ==================================================================   BUG: KASAN: slab-use-after-free in mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881   Read of size 4 at addr ffff8880569ac858 by task syz.1.2799/14662    CPU: 0 UID: 0 PID: 14662 Comm: syz.1.2799 Not tainted 6.12.0-rc2-syzkaller-00307-g36c254515dc6 #0   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014   Call Trace:    \u0026lt;TASK\u0026gt;    __dump_stack lib/dump_stack.c:94 [inline]    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120    print_address_description mm/kasan/report.c:377 [inline]    print_report+0xc3/0x620 mm/kasan/report.c:488    kasan_report+0xd9/0x110 mm/kasan/report.c:601    mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881    mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:914 [inline]    mptcp_nl_remove_id_zero_address+0x305/0x4a0 net/mptcp/pm_netlink.c:1572    mptcp_pm_nl_del_addr_doit+0x5c9/0x770 net/mptcp/pm_netlink.c:1603    genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]    genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210    netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2551    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219    netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]    netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1357    netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901    sock_sendmsg_nosec net/socket.c:729 [inline]    __sock_sendmsg net/socket.c:744 [inline]    ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2607    ___sys_sendmsg+0x135/0x1e0 net/socket.c:2661    __sys_sendmsg+0x117/0x1f0 net/socket.c:2690    do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]    __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386    do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411    entry_SYSENTER_compat_after_hwframe+0x84/0x8e   RIP: 0023:0xf7fe4579   Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 \u0026lt;5d\u0026gt; 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00   RSP: 002b:00000000f574556c EFLAGS: 00000296 ORIG_RAX: 0000000000000172   RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000020000140   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000   RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000   R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000    \u0026lt;/TASK\u0026gt;    Allocated by task 5387:    kasan_save_stack+0x33/0x60 mm/kasan/common.c:47    kasan_save_track+0x14/0x30 mm/kasan/common.c:68    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]    __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394    kmalloc_noprof include/linux/slab.h:878 [inline]    kzalloc_noprof include/linux/slab.h:1014 [inline]    subflow_create_ctx+0x87/0x2a0 net/mptcp/subflow.c:1803    subflow_ulp_init+0xc3/0x4d0 net/mptcp/subflow.c:1956    __tcp_set_ulp net/ipv4/tcp_ulp.c:146 [inline]    tcp_set_ulp+0x326/0x7f0 net/ipv4/tcp_ulp.c:167    mptcp_subflow_create_socket+0x4ae/0x10a0 net/mptcp/subflow.c:1764    __mptcp_subflow_connect+0x3cc/0x1490 net/mptcp/subflow.c:1592    mptcp_pm_create_subflow_or_signal_addr+0xbda/0x23a0 net/mptcp/pm_netlink.c:642    mptcp_pm_nl_fully_established net/mptcp/pm_netlink.c:650 [inline]    mptcp_pm_nl_work+0x3a1/0x4f0 net/mptcp/pm_netlink.c:943    mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2777    process_one_work+0x958/0x1b30 kernel/workqueue.c:3229    process_scheduled_works kernel/workqueue.c:3310 [inline]    worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391    kthread+0x2c1/0x3a0 kernel/kthread.c:389    ret_from_fork+0x45/0x80 arch/x86/ke ---truncated---(CVE-2024-50085)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  unicode: Don\u0026apos;t special case ignorable code points  We don\u0026apos;t need to handle them separately. Instead, just let them decompose/casefold to themselves.(CVE-2024-50089)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context  PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services.  The issue arises because the PRMT is finding a block of type EFI_CONVENTIONAL_MEMORY, which is not appropriate for runtime services as described in Section 2.2.2 (Runtime Services) of the UEFI Specification [1]. Since the PRM handler is a type of runtime service, this causes an exception when the PRM handler is called.      [Firmware Bug]: Unable to handle paging request in EFI runtime service     WARNING: CPU: 22 PID: 4330 at drivers/firmware/efi/runtime-wrappers.c:341         __efi_queue_work+0x11c/0x170     Call trace:  Let PRMT find a block with EFI_MEMORY_RUNTIME for PRM handler and PRM context.  If no suitable block is found, a warning message will be printed, but the procedure continues to manage the next PRM handler.  However, if the PRM handler is actually called without proper allocation, it would result in a failure during error handling.  By using the correct memory types for runtime services, ensure that the PRM handler and the context are properly mapped in the virtual address space during runtime, preventing the paging request error.  The issue is really that only memory that has been remapped for runtime by the firmware can be used by the PRM handler, and so the region needs to have the EFI_MEMORY_RUNTIME attribute.  [ rjw: Subject and changelog edits ](CVE-2024-50141)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  udf: fix uninit-value use in udf_get_fileshortad  Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].  [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000(CVE-2024-50143)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ceph: remove the incorrect Fw reference check when dirtying pages  When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won\u0026apos;t hold the Fw caps and there is case will it get the Fw reference.(CVE-2024-50179)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  fbdev: sisfb: Fix strbuf array overflow  The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1. The strbuf1 array contains digit characters and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, \u0026quot;%ux%ux8\u0026quot;, xres, yres); more than 16 bytes will be written to strbuf. It is suggested to increase the size of the strbuf array to 24.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50180)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  irqchip/gic-v4: Don\u0026apos;t allow a VMOVP on a dying VPE  Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/.  Plug the race by checking the value of vmapp_count, which tracks whether the VPE is mapped ot not, and returning an error in this case.  This involves making vmapp_count common to both GICv4.1 and its v4.0 ancestor.(CVE-2024-50192)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  posix-clock: Fix missing timespec64 check in pc_clock_settime()  As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct\u0026apos;s tv_sec and tv_nsec range before calling ptp-\u0026gt;info-\u0026gt;settime64().  As the man manual of clock_settime() said, if tp.tv_sec is negative or tp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL, which include dynamic clocks which handles PTP clock, and the condition is consistent with timespec64_valid(). As Thomas suggested, timespec64_valid() only check the timespec is valid, but not ensure that the time is in a valid range, so check it ahead using timespec64_valid_strict() in pc_clock_settime() and return -EINVAL if not valid.  There are some drivers that use tp-\u0026gt;tv_sec and tp-\u0026gt;tv_nsec directly to write registers without validity checks and assume that the higher layer has checked it, which is dangerous and will benefit from this, such as hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(), and some drivers can remove the checks of itself.(CVE-2024-50195)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: propagate directory read errors from nilfs_find_entry()  Syzbot reported that a task hang occurs in vcs_open() during a fuzzing test for nilfs2.  The root cause of this problem is that in nilfs_find_entry(), which searches for directory entries, ignores errors when loading a directory page/folio via nilfs_get_folio() fails.  If the filesystem images is corrupted, and the i_size of the directory inode is large, and the directory page/folio is successfully read but fails the sanity check, for example when it is zero-filled, nilfs_check_folio() may continue to spit out error messages in bursts.  Fix this issue by propagating the error to the callers when loading a page/folio fails in nilfs_find_entry().  The current interface of nilfs_find_entry() and its callers is outdated and cannot propagate error codes such as -EIO and -ENOMEM returned via nilfs_find_entry(), so fix it together.(CVE-2024-50202)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()  The step variable is initialized to zero. It is changed in the loop, but if it\u0026apos;s not changed it will remain zero. Add a variable check before the division.  The observed behavior was introduced by commit 826b5de90c0b (\u0026quot;ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size\u0026quot;), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table.  Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50205)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix potential deadlock with newly created symlinks  Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among the reader/writer semaphore nilfs-\u0026gt;ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the fs_reclaim pseudo lock.  This is because after commit 21fc61c73c39 (\u0026quot;don\u0026apos;t put symlink bodies in pagecache into highmem\u0026quot;), the gfp flags of the page cache for symbolic links are overwritten to GFP_KERNEL via inode_nohighmem().  This is not a problem for symlinks read from the backing device, because the __GFP_FS flag is dropped after inode_nohighmem() is called.  However, when a new symlink is created with nilfs_symlink(), the gfp flags remain overwritten to GFP_KERNEL.  Then, memory allocation called from page_symlink() etc.  triggers memory reclamation including the FS layer, which may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can cause a deadlock if they are called while nilfs-\u0026gt;ns_segctor_sem is held:  Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs_new_inode() and __nilfs_read_inode() do, as a workaround until we adopt nofs allocation scope consistently or improve the locking constraints.(CVE-2024-50229)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix kernel bug due to missing clearing of checked flag  Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug.  This was found to be because the \u0026quot;checked\u0026quot; flag of a page/folio was not cleared when it was discarded by nilfs2\u0026apos;s own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded.  So, fix that.  This was necessary when the use of nilfs2\u0026apos;s own page discard routine was applied to more than just metadata files.(CVE-2024-50230)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Initialize struct nfsd4_copy earlier  Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.(CVE-2024-50241)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ntfs3: Add bounds checking to mi_enum_attr()  Added bounds checking to make sure that every attr don\u0026apos;t stray beyond valid memory region.(CVE-2024-50248)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: Fix out-of-bounds write in trie_get_next_key()  trie_get_next_key() allocates a node stack with size trie-\u0026gt;max_prefixlen, while it writes (trie-\u0026gt;max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.(CVE-2024-50262)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()  Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():  [   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry [   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [   57.331328] Call Trace: [   57.331477]  \u0026lt;TASK\u0026gt; [...] [   57.333511]  ? do_user_addr_fault+0x3e5/0x740 [   57.333778]  ? exc_page_fault+0x70/0x170 [   57.334016]  ? asm_exc_page_fault+0x2b/0x30 [   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0 [   57.335164]  ocfs2_xa_set+0x704/0xcf0 [   57.335381]  ? _raw_spin_unlock+0x1a/0x40 [   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20 [   57.335915]  ? trace_preempt_on+0x1e/0x70 [   57.336153]  ? start_this_handle+0x16c/0x500 [   57.336410]  ? preempt_count_sub+0x50/0x80 [   57.336656]  ? _raw_read_unlock+0x20/0x40 [   57.336906]  ? start_this_handle+0x16c/0x500 [   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0 [   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0 [   57.337706]  ? ocfs2_start_trans+0x13d/0x290 [   57.337971]  ocfs2_xattr_set+0xb13/0xfb0 [   57.338207]  ? dput+0x46/0x1c0 [   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30 [   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30 [   57.338948]  __vfs_removexattr+0x92/0xc0 [   57.339182]  __vfs_removexattr_locked+0xd5/0x190 [   57.339456]  ? preempt_count_sub+0x50/0x80 [   57.339705]  vfs_removexattr+0x5f/0x100 [...]  Reproducer uses faultinject facility to fail ocfs2_xa_remove() -\u0026gt; ocfs2_xa_value_truncate() with -ENOMEM.  In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following \u0026apos;rc\u0026apos; check is wrong and execution flow do \u0026apos;ocfs2_xa_remove_entry(loc);\u0026apos; twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to \u0026apos;out\u0026apos;.  Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy.(CVE-2024-50265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  usb: musb: sunxi: Fix accessing an released usb phy  Commit 6ed05c68cbca (\u0026quot;usb: musb: sunxi: Explicitly release USB PHY on exit\u0026quot;) will cause that usb phy @glue-\u0026gt;xceiv is accessed after released.  1) register platform driver @sunxi_musb_driver // get the usb phy @glue-\u0026gt;xceiv sunxi_musb_probe() -\u0026gt; devm_usb_get_phy().  2) register and unregister platform driver @musb_driver musb_probe() -\u0026gt; sunxi_musb_init() use the phy here //the phy is released here musb_remove() -\u0026gt; sunxi_musb_exit() -\u0026gt; devm_usb_put_phy()  3) register @musb_driver again musb_probe() -\u0026gt; sunxi_musb_init() use the phy here but the phy has been released at 2). ...  Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().(CVE-2024-50269)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: reinitialize delayed ref list after deleting it from the list  At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0026apos;s ref_add_list using list_del(), which leaves the ref\u0026apos;s add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively.  If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref\u0026apos;s add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise.  So fix this by deleting from the list with list_del_init() instead.(CVE-2024-50273)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: av7110: fix a spectre vulnerability  As warned by smatch:  drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue \u0026apos;av7110-\u0026gt;ci_slot\u0026apos; [w] (local cap)  There is a spectre-related vulnerability at the code. Fix it.(CVE-2024-50289)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  security/keys: fix slab-out-of-bounds in key_task_permission  KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 security/keys/permission.c:54 Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362  CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 Call Trace:  __dump_stack lib/dump_stack.c:82 [inline]  dump_stack+0x107/0x167 lib/dump_stack.c:123  print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400  __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560  kasan_report+0x3a/0x50 mm/kasan/report.c:585  __kuid_val include/linux/uidgid.h:36 [inline]  uid_eq include/linux/uidgid.h:63 [inline]  key_task_permission+0x394/0x410 security/keys/permission.c:54  search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793  This issue was also reported by syzbot.  It can be reproduced by following these steps(more details [1]): 1. Obtain more than 32 inputs that have similar hashes, which ends with the    pattern \u0026apos;0xxxxxxxe6\u0026apos;. 2. Reboot and add the keys obtained in step 1.  The reproducer demonstrates how this issue happened: 1. In the search_nested_keyrings function, when it iterates through the    slots in a node(below tag ascend_to_node), if the slot pointer is meta    and node-\u0026gt;back_pointer != NULL(it means a root), it will proceed to    descend_to_node. However, there is an exception. If node is the root,    and one of the slots points to a shortcut, it will be treated as a    keyring. 2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function.    However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as    ASSOC_ARRAY_PTR_SUBTYPE_MASK. 3. When 32 keys with the similar hashes are added to the tree, the ROOT    has keys with hashes that are not similar (e.g. slot 0) and it splits    NODE A without using a shortcut. When NODE A is filled with keys that    all hashes are xxe6, the keys are similar, NODE A will split with a    shortcut. Finally, it forms the tree as shown below, where slot 6 points    to a shortcut.                        NODE A               +------\u0026gt;+---+       ROOT    |       | 0 | xxe6       +---+   |       +---+  xxxx | 0 | shortcut  :   : xxe6       +---+   |       +---+  xxe6 :   :   |       |   | xxe6       +---+   |       +---+       | 6 |---+       :   : xxe6       +---+           +---+  xxe6 :   :           | f | xxe6       +---+           +---+  xxe6 | f |       +---+  4. As mentioned above, If a slot(slot 6) of the root points to a shortcut,    it may be mistakenly transferred to a key*, leading to a read    out-of-bounds read.  To fix this issue, one should jump to descend_to_node if the ptr is a shortcut, regardless of whether the node is root or not.  [1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/  [jarkko: tweaked the commit message a bit to have an appropriate closes  tag.](CVE-2024-50301)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write  When io_uring starts a write, it\u0026apos;ll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write:  task:fio             state:D stack:0     pid:886   tgid:886   ppid:876 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_rwsem_wait+0x1e8/0x3f8  __percpu_down_read+0xe8/0x500  io_write+0xbb8/0xff8  io_issue_sqe+0x10c/0x1020  io_submit_sqes+0x614/0x2110  __arm64_sys_io_uring_enter+0x524/0x1038  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170 INFO: task fsfreeze:7364 blocked for more than 15 seconds.       Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963  with the attempting freezer stuck trying to grab the rwsem:  task:fsfreeze        state:D stack:0     pid:7364  tgid:7364  ppid:995 Call trace:  __switch_to+0x1d8/0x348  __schedule+0x8e8/0x2248  schedule+0x110/0x3f0  percpu_down_write+0x2b0/0x680  freeze_super+0x248/0x8a8  do_vfs_ioctl+0x149c/0x1b18  __arm64_sys_ioctl+0xd0/0x1a0  invoke_syscall+0x74/0x268  el0_svc_common.constprop.0+0x160/0x238  do_el0_svc+0x44/0x60  el0_svc+0x44/0xb0  el0t_64_sync_handler+0x118/0x128  el0t_64_sync+0x168/0x170  Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn\u0026apos;t set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress.  Since freezing requires CAP_SYS_ADMIN in the first place, this isn\u0026apos;t something that can be triggered by a regular user.(CVE-2024-53052)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: s5p-jpeg: prevent buffer overflows  The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it.  While here, remove an unused word = 0 assignment.(CVE-2024-53061)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nfs: Fix KMSAN warning in decode_getfattr_attrs()  Fix the following KMSAN warning:  CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_attrs+0x2d6d/0x2f90  decode_getfattr_generic+0x806/0xb00  nfs4_xdr_dec_getattr+0x1de/0x240  rpcauth_unwrap_resp_decode+0xab/0x100  rpcauth_unwrap_resp+0x95/0xc0  call_decode+0x4ff/0xb50  __rpc_execute+0x57b/0x19d0  rpc_execute+0x368/0x5e0  rpc_run_task+0xcfe/0xee0  nfs4_proc_getattr+0x5b5/0x990  __nfs_revalidate_inode+0x477/0xd00  nfs_access_get_cached+0x1021/0x1cc0  nfs_do_access+0x9f/0xae0  nfs_permission+0x1e4/0x8c0  inode_permission+0x356/0x6c0  link_path_walk+0x958/0x1330  path_lookupat+0xce/0x6b0  filename_lookup+0x23e/0x770  vfs_statx+0xe7/0x970  vfs_fstatat+0x1f2/0x2c0  __se_sys_newfstatat+0x67/0x880  __x64_sys_newfstatat+0xbd/0x120  x64_sys_call+0x1826/0x3cf0  do_syscall_64+0xd0/0x1b0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr-\u0026gt;mdsthreshold is not initialized.  Fix the issue by initializing fattr-\u0026gt;mdsthreshold to NULL in nfs_fattr_init().(CVE-2024-53066)","status":"published","published":"2024-11-29T11:07:58Z","modified":"2026-08-18T01:18:41.985648535Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-50241","description":"In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.","status":"published","published":"2024-11-09T11:15:00Z","modified":"2026-11-10T02:49:45.803108572Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T03:18:09.499589Z"},{"id":"openSUSE-SU-2024:14500-1","title":"kernel-devel-6.11.8-1.1 on GA media","description":"These are all security issues fixed in the kernel-devel-6.11.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-15T00:00:00Z","modified":"2026-02-04T03:05:15.769912Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14705-1","title":"kernel-devel-longterm-6.12.11-1.1 on GA media","description":"These are all security issues fixed in the kernel-devel-longterm-6.12.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-28T00:00:00Z","modified":"2026-02-04T03:17:00.28177Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2026:24550-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).\n- CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).\n- CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).\n- CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).\n- CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).\n- CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).\n- CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).\n- CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).\n- CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).\n- CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).\n- CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).\n- CVE-2026-72110: bpf,fork: wipe -\u003ebpf_storage before bailouts that access it (bsc#1277357).\n- CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).\n- CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).\n- CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).\n- CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).\n- CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).\n- CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).\n- CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).\n- CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).\n- CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).\n- CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).\n- CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).\n- CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).\n- CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).\n- CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).\n- CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).\n- CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).\n- CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).\n- CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).\n- CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).\n- CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).\n- CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).\n- CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).\n- CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).\n- CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).\n- CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).\n- CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).\n- CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).\n- CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).\n- CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).\n- CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).\n- CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (bsc#1279494).\n- CVE-2026-80881: ocfs2: fix buffer head management in ocfs2_read_blocks() (bsc#1279496).\n- CVE-2026-80978: ip6_gre: fix hardware header length for NBMA tunnels (bsc#1280253).\n- CVE-2026-80988: NTB: ntb_transport: Fail TX enqueue when the QP link is down (bsc#1280266).\n- CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (bsc#1280472).\n- CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler (bsc#1280520).\n- CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler (bsc#1280569).\n- CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (bsc#1280713).\n- CVE-2026-89554: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (bsc#1280736).\n- CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (bsc#1280554).\n- CVE-2026-89560: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (bsc#1280806).\n- CVE-2026-89595: fsnotify: Fix stale object mask after concurrent mark updates (bsc#1280834).\n- CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826).\n- CVE-2026-89637: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (bsc#1280492).\n- CVE-2026-89642: cifs: call pagecache_isize_extended() in cifs_setsize() when extending (bsc#1280970).\n- CVE-2026-89649: ceph: bound xattr value length in __build_xattrs() (bsc#1280434).\n- CVE-2026-89654: ceph: fix UAF in check_new_map() on session freed during unlock (bsc#1280415).\n- CVE-2026-89655: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (bsc#1280398).\n- CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563).\n- CVE-2026-89657: libceph: validate OSD extent maps before cursor advance (bsc#1280545).\n- CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling (bsc#1280822).\n- CVE-2026-89761: apparmor: fix out-of-bounds write when null terminating a label vec (bsc#1280745).\n- CVE-2026-89786: ext4: fix out-of-bounds read in ext4_read_inline_dir() (bsc#1280976).\n- CVE-2026-89787: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (bsc#1280977).\n- CVE-2026-90042: ceph: properly decrypt filenames in vmalloc() buffers (bsc#1280948).\n- CVE-2026-90057: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (bsc#1281650).\n- CVE-2026-90081: net/rds: use wq_has_sleeper() in rds_cong_map_updated() (bsc#1281490).\n- CVE-2026-90092: Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (bsc#1281384).\n- CVE-2026-90103: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (bsc#1281538).\n- CVE-2026-90107: net/smc: free pending qentry in smc_llc_flow_stop() before memset (bsc#1281510).\n- CVE-2026-90114: net: bridge: Reject descending VLAN tunnel ranges (bsc#1281509).\n- CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (bsc#1281577).\n- CVE-2026-90138: vsock: don't check the listener's sk_err in vsock_accept() (bsc#1281535).\n- CVE-2026-90148: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (bsc#1281551).\n- CVE-2026-90227: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (bsc#1281705).\n- CVE-2026-90230: nvme: Add the DHCHAP maximum HD IDs (bsc#1281715).\n- CVE-2026-90393: bpf: Fix potential UAF in bpf_netns_link_update_prog (bsc#1282289).\n- CVE-2026-93054: uio: Fix stale info pointer in failed registration path (bsc#1282276).\n- CVE-2026-93228: svcrdma: Reject Write/Reply chunks with segcount 0 (bsc#1282697).\n- CVE-2026-93231: lockd: fix swapped arguments in nlmsvc_match_ip() (bsc#1282778).\n- CVE-2026-93250: vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() (bsc#1282677).\n- CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush() (bsc#1283004).\n- CVE-2026-93795: blk-cgroup: fix leaks and online flag on radix_tree_insert failure (bsc#1283155).\n- CVE-2026-93798: btrfs: fix reloc root cleanup in merge_reloc_roots() (bsc#1282769).\n- CVE-2026-93817: perf: Fix addr_filter_ranges lifetime (bsc#1283017).\n- CVE-2026-93828: exfat: fix handling of damaged volume in exfat_create_upcase_table() (bsc#1282890).\n- CVE-2026-93830: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (bsc#1282889).\n- CVE-2026-97554: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() (bsc#1283850).\n- CVE-2026-97556: smb: client: avoid leaking refcount when cifs_sb_tlink() fails (bsc#1283853).\n- CVE-2026-97558: smb: client: fix cifsFileInfo reference leak in deferred close (bsc#1283855).\n- CVE-2026-97559: smb: client: fail DACL rewrite when the new DACL exceeds 64K (bsc#1283856).\n- CVE-2026-97561: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid (bsc#1283858).\n- CVE-2026-97562: smb: client: pin DFS superblock in iterator callback (bsc#1283862).\n- CVE-2026-97563: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (bsc#1283877).\n- CVE-2026-97565: smb: client: reject short READ responses in CIFSSMBRead() (bsc#1283793).\n- CVE-2026-97575: media: v4l2-ctrls: validate AV1 tile counts (bsc#1283337).\n- CVE-2026-97596: ipvs: reject invalid states in connection template sync records (bsc#1283941).\n- CVE-2026-97603: idpf: disable DIM work before freeing q_vectors (bsc#1283782).\n- CVE-2026-97612: net: mpls: clear inner_protocol when the last label is popped (bsc#1283967).\n- CVE-2026-97954: net/rds: fix tcp stream corruption with large pages (bsc#1283113).\n- CVE-2026-97963: net: stmmac: initialize ptp_lock at probe time (bsc#1282984).\n- CVE-2026-97964: ppp_synctty: ensure a writeable skb header (bsc#1282962).\n- CVE-2026-97965: vxlan: initialize _md in vxlan_xmit_one() (bsc#1282963).\n- CVE-2026-97991: vdpa_sim_blk: reject out-of-range sector starts (bsc#1283356).\n- CVE-2026-97993: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx (bsc#1283339).\n- CVE-2026-98014: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (bsc#1283668).\n- CVE-2026-98022: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (bsc#1283810).\n- CVE-2026-98023: vxlan: reject dynamic fdb entries that reference a nexthop id (bsc#1283960).\n- CVE-2026-98031: nexthop: Initialize extack in remove_nh_grp_entry() (bsc#1283662).\n- CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).\n- CVE-2026-98068: net/rds: don't let rds_conn_shutdown() consume a concurrent drop (bsc#1283903).\n- CVE-2026-98069: net/rds: acquire the fastpath locks in rds_conn_shutdown() (bsc#1283863).\n- CVE-2026-98070: net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() (bsc#1283916).\n- CVE-2026-98071: net/rds: clear cp_flags bits individually in rds_conn_path_reset() (bsc#1283842).\n- CVE-2026-98072: net/rds: use wq_has_sleeper() in release_in_xmit() (bsc#1283846).\n- CVE-2026-98074: bonding: do not clear curr_active_slave prematurely when releasing all slaves (bsc#1283871).\n- CVE-2026-98078: ipvs: fix reversed sequence option serialization (bsc#1284150).\n- CVE-2026-98095: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header() (bsc#1283921).\n- CVE-2026-98122: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() (bsc#1283886).\n- CVE-2026-98124: smb/client: invalidate fscache for fallocate range operations (bsc#1283821).\n- CVE-2026-98125: smb/client: fix stale page cache in insert/collapse range (bsc#1283812).\n- CVE-2026-98126: smb/client: validate new EOF for zero range (bsc#1283859).\n- CVE-2026-98127: smb/client: validate new EOF for insert range (bsc#1283873).\n- CVE-2026-98154: nvme-rdma: fix -EIO cleanup order in queue_rq (bsc#1283418).\n- CVE-2026-98158: ppp_async: drop the errored frame instead of resetting its headroom (bsc#1283933).\n- CVE-2026-98167: smb: client: fix server-\u003etotal_read for compound encrypted PDUs (bsc#1284422).\n- CVE-2026-98169: smb: client: fix potential OOB read in smb3_enum_snapshots() (bsc#1284298).\n- CVE-2026-98170: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() (bsc#1284310).\n- CVE-2026-98175: smb: client: cancel reconnect work in clean_demultiplex_info() (bsc#1284312).\n- CVE-2026-98257: rds: ib: use rds_conn_drop() on protocol version mismatch (bsc#1284346).\n- CVE-2026-98258: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list (bsc#1284584).\n- CVE-2026-98261: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (bsc#1284605).\n- CVE-2026-98264: ALSA: virtio: reset device before deleting virtqueues (bsc#1284363).\n- CVE-2026-98282: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (bsc#1284360).\n- CVE-2026-98283: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() (bsc#1284595).\n- CVE-2026-98306: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (bsc#1284505).\n- CVE-2026-98368: esp: downgrade zerocopy managed frags before mutating skb frags (bsc#1284498).\n- CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (bsc#1284740).\n- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).\n- CVE-2026-98471: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (bsc#1286240).\n- CVE-2026-98631: xsk: Use a 32-bit compare in xsk_map_gen_lookup (bsc#1286233).\n- CVE-2026-99131: xfs: fix capability check in xfs (bsc#1288668).\n- CVE-2026-100071: net: hsr: free learned nodes on device setup failure (bsc#1282870).\n\nThe following non security issues were fixed:\n\n- accel/qaic: reject BO sizes that overflow page count (git-fixes).\n- ACPI: CPPC: Validate the _CPC package header (git-fixes).\n- ACPI: extlog: Validate elog record length before walking sections (git-fixes).\n- ACPI: PCI: pci_link: clear driver_data before free (git-fixes).\n- ACPI: pfr_update: zero-initialize capability query result (git-fixes).\n- ACPI: PM: Drop parent state update from acpi_device_get_power() (git-fixes).\n- ACPI: tables: handle failed initrd override mappings (git-fixes).\n- ACPI: TAD: Rearrange RT data validation checking (stable-fixes).\n- ACPI: video: Fix backlight unregistration ordering (git-fixes).\n- ACPICA: Fix memory leak in acpi_ds_create_field() (git-fixes).\n- ACPICA: Fix PCC OperationRegion command offsets (git-fixes).\n- ACPICA: Initialize parser_state.aml_end in acpi_install_method() (git-fixes).\n- ALSA: 6fire: take stream_mutex in the Digital Thru control (git-fixes).\n- ALSA: aloop: Keep the timer source alive until card release (git-fixes).\n- ALSA: caiaq: Fix races at MIDI URB and trigger accesses (git-fixes).\n- ALSA: caiaq: Fix the Kore controller key map (git-fixes).\n- ALSA: caiaq: Register card at the final step (git-fixes).\n- ALSA: caiaq: Serialize access to the EP1 command buffer (git-fixes).\n- ALSA: compress: add missing OPEN-state gate to SET_METADATA (git-fixes).\n- ALSA: control: Fix virtual master creation reference in kernel-doc (git-fixes).\n- ALSA: cs46xx: fix unit mismatch in DSP code area bounds check (git-fixes).\n- ALSA: hda/hdmi: clamp num_cvts against cvt_nids in hdmi_read_pin_conn (git-fixes).\n- ALSA: hda/hdmi: clamp sad_count in ELD proc write handler (git-fixes).\n- ALSA: hda: Add NULL check for the driver pointer at unsol event work (git-fixes).\n- ALSA: hda: Avoid non-operational GPU warning at regular device removal (git-fixes).\n- ALSA: hda: Fix potential UAF for gating jack (git-fixes).\n- ALSA: hda: intel: Cancel delayed work at shutdown, too (git-fixes).\n- ALSA: hda: Reject codec reset on ASoC (ext_ops) buses (git-fixes).\n- ALSA: jack: Fix kctl free at error in snd_jack_kctl_new() (git-fixes).\n- ALSA: line6: Clear prev_fbuf on capture buffer release (git-fixes).\n- ALSA: line6: Fix potential OOB write in line6_capture_copy() (git-fixes).\n- ALSA: line6: Reject too small max packet sizes (git-fixes).\n- ALSA: line6: Use kzalloc() for PCM buffer allocation (git-fixes).\n- ALSA: pcm: Fix driver_tstamp value reporting (git-fixes).\n- ALSA: pcm: Protect channel-map reads against runtime detach (git-fixes).\n- ALSA: pcm: Protect the unregister notifier traversal (git-fixes).\n- ALSA: pcm: Remove channel-map controls before freeing substreams (git-fixes).\n- ALSA: pcm: Unlink substreams before releasing them (git-fixes).\n- ALSA: seq: oss: Skip events until fully initialized (git-fixes).\n- ALSA: sh: aica: Fix spu_memset() stride (git-fixes).\n- ALSA: ump: Correct return size of fill_rpn() (git-fixes).\n- ALSA: usb-audio: Use fixed control index for us16x08 mixer elements (git-fixes).\n- ALSA: via82xx: use helper to activate DXS controls (git-fixes).\n- ASoC: adau17x1: return cache sync errors from resume (git-fixes).\n- ASoC: ak4642: return cache sync errors from resume (git-fixes).\n- ASoC: amd: acp: Fix .close() being skipped on rollback (git-fixes).\n- ASoC: amd: ps: Fix acp63_pdm_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: ps: Fix acp63_sdw_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: raven: Fix acp3x_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: raven: Fix memory leak in acp3x_dma_close() (git-fixes).\n- ASoC: amd: renoir: Fix acp_pdm_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: vangogh: Fix acp5x_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) (stable-fixes).\n- ASoC: amd: yc: Fix acp6x_pdm_dma_close() being skipped on rollback (git-fixes).\n- ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() (git-fixes).\n- ASoC: atmel-i2s: fix MCK generator error handling (git-fixes).\n- ASoC: atmel-i2s: use optional API for gclk (git-fixes).\n- ASoC: atmel-i2s: use optional API for muxclk (git-fixes).\n- ASoC: atmel: atmel-pcm-pdc: Fix atmel_pcm_close() being skipped on rollback (git-fixes).\n- ASoC: codecs: da732x: Fix definition of ADC2 EQ Overall Volume control (git-fixes).\n- ASoC: codecs: es*: Modify the registers related to ALC RECOVERY (git-fixes).\n- ASoC: codecs: rt5659: propagate GPIO errors (git-fixes).\n- ASoC: codecs: rt5682s: disable jack detection work on shutdown (git-fixes).\n- ASoC: codecs: sta32x: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).\n- ASoC: codecs: sta32x: Fix definition of limiter threshold controls (git-fixes).\n- ASoC: codecs: sta350: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).\n- ASoC: codecs: sta350: Fix definition of limiter threshold controls (git-fixes).\n- ASoC: codecs: tlv320adc3xxx: Fix definition of AGC Target Level control (git-fixes).\n- ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() (git-fixes).\n- ASoC: codecs: wm5100: Fix definition of EQ3 Band 1 Volume control (git-fixes).\n- ASoC: codecs: wm8510: Fix definition of ADC Inversion Switch control (git-fixes).\n- ASoC: codecs: wm8737: Fix definition of zero cross switches (git-fixes).\n- ASoC: codecs: wm8750: Fix definition of ALC Capture NG Type control (git-fixes).\n- ASoC: codecs: wm8955: Fix definition of Treble Cutoff control (git-fixes).\n- ASoC: codecs: wm8983: Fix definition of ADC 128x Oversampling control (git-fixes).\n- ASoC: codecs: wm8985: Fix definition of ADC 128x Oversampling control (git-fixes).\n- ASoC: codecs: wm8990: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).\n- ASoC: codecs: wm8990: Fix definition of right input PGA controls (git-fixes).\n- ASoC: codecs: wm8991: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).\n- ASoC: codecs: wm8991: Fix definition of right input PGA controls (git-fixes).\n- ASoC: codecs: wm8994: Fix definition of WM8958 noise gate hold time controls (git-fixes).\n- ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() (git-fixes).\n- ASoC: codecs: wm_hubs: Fix definition of MIXINR to MIXOUTR volume control (git-fixes).\n- ASoC: codecs: wsa883x: disable runtime PM on unbind (git-fixes).\n- ASoC: codecs: wsa884x: disable runtime PM on unbind (git-fixes).\n- ASoC: cs42l56: Remove the ADC Mute Switch control (git-fixes).\n- ASoC: es8316: return cache sync errors from resume (git-fixes).\n- ASoC: fsl_asrc: check the second front-end DMA channel (git-fixes).\n- ASoC: fsl_asrc: use regmap_write_bits to update clock source registers (git-fixes).\n- ASoC: hdac_hda: Balance the runtime PM disable in codec remove (git-fixes).\n- ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe (git-fixes).\n- ASoC: hdac_hda: Restore the codec device type on unbind (git-fixes).\n- ASoC: imx-pcm-rpmsg: Fix imx_rpmsg_pcm_close() being skipped on rollback (git-fixes).\n- ASoC: intel: atom: Fix .shutdown() being skipped on rollback (git-fixes).\n- ASoC: Intel: atom: Fix platform device leak on probe failure (git-fixes).\n- ASoC: Intel: avs: Prevent module info underflow (git-fixes).\n- ASoC: Intel: avs: Unprepare a stream when recovery occurs (git-fixes).\n- ASoC: mediatek: common: Handle constraint return value in FE startup (git-fixes).\n- ASoC: mediatek: mt6797: fix wrong unwind order and error code in enable_clock (git-fixes).\n- ASoC: mediatek: mt8183: Fix APLL enable error handling (git-fixes).\n- ASoC: mediatek: mt8183: Fix clock handling in mux disable path (git-fixes).\n- ASoC: mediatek: mt8183: Fix wrong clock cleanup on clk_set_parent() failure (git-fixes).\n- ASoC: mediatek: mt8186: Fix AFE clock error handling (git-fixes).\n- ASoC: mediatek: mt8186: Fix APLL enable error handling (git-fixes).\n- ASoC: mediatek: mt8186: Fix APLL mux setting error handling (git-fixes).\n- ASoC: mediatek: mt8186: Fix clock handling in mux disable path (git-fixes).\n- ASoC: mediatek: mt8186: Fix MCK error handling (git-fixes).\n- ASoC: mediatek: mt8188: Handle constraint return value in FE startup (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-clk: Handle clock enable errors (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-clk: Handle tuner clock enable errors (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-clk: Propagate regmap update errors (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-pcm: Handle runtime resume errors (git-fixes).\n- ASoC: mediatek: mt8192-mt6359: Fix error handling in MTKAIF calibration (git-fixes).\n- ASoC: mediatek: mt8192: check return values in mt8192_afe_gpio_init() (git-fixes).\n- ASoC: mediatek: mt8192: fix AFE clock error handling (git-fixes).\n- ASoC: mediatek: mt8192: fix APLL mux error handling (git-fixes).\n- ASoC: mediatek: mt8192: fix error handling in APLL enable functions (git-fixes).\n- ASoC: mediatek: mt8192: fix MCK clock error handling (git-fixes).\n- ASoC: mediatek: mt8192: Handle regcache_sync() failure in runtime resume (git-fixes).\n- ASoC: mediatek: mt8192: Propagate errors in TDM DAI DAPM event handlers (git-fixes).\n- ASoC: mediatek: mt8192: Propagate mt8192_afe_gpio_request() errors in ADDA DAI (git-fixes).\n- ASoC: mediatek: mt8192: switch to devm_clk_get_optional() (git-fixes).\n- ASoC: mediatek: mt8195: Check paired MEMIF clock enable in FE trigger (git-fixes).\n- ASoC: mediatek: mt8195: Fix ETDM MCLK error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix ETDM probe error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix ETDM startup error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix FE startup error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix HDMI TX startup error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix main clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix paired memif clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix register access clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix runtime resume error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix timing system clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix tuner clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Propagate IRQ lookup errors (git-fixes).\n- ASoC: mt6359-accdet: manage private workqueues with devres (git-fixes).\n- ASoC: nau8540: return cache sync errors from resume (git-fixes).\n- ASoC: ops: Fix return value in snd_soc_limit_volume() (git-fixes).\n- ASoC: qcom: q6apm: clear g_apm on driver removal (git-fixes).\n- ASoC: qcom: qdsp6: q6afe: fix clk vote response type mismatch (git-fixes).\n- ASoC: rockchip: rockchip_i2s: Handle runtime PM resume failures in set_fmt (git-fixes).\n- ASoC: rt711-sdca: always cancel jack work on remove (git-fixes).\n- ASoC: rt711-sdw: always cancel jack work on remove (git-fixes).\n- ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls (git-fixes).\n- ASoC: rt712-sdca: always cancel jack work on remove (git-fixes).\n- ASoC: rt722-sdca: always cancel jack work on remove (git-fixes).\n- ASoC: rt1011: return cache sync errors from resume (git-fixes).\n- ASoC: rt1016: return cache sync errors from resume (git-fixes).\n- ASoC: rt1305: return cache sync errors from resume (git-fixes).\n- ASoC: rt1308: return cache sync errors from resume (git-fixes).\n- ASoC: rt5616: return cache sync errors from resume (git-fixes).\n- ASoC: rt5659: return cache sync errors from resume (git-fixes).\n- ASoC: rt5660: return cache sync errors from resume (git-fixes).\n- ASoC: rt5665: return cache sync errors from resume (git-fixes).\n- ASoC: rt5682-sdw: always cancel jack work on remove (git-fixes).\n- ASoC: soc-ac97: Fix error handling in snd_soc_new_ac97_component() (git-fixes).\n- ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer() (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() (git-fixes).\n- ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() (git-fixes).\n- ASoC: wcd-mbhc-v2: Fix incorrect properties names and typos (git-fixes).\n- ASoC: wm8994: don't lose the AIF clock ratio when staying at 32kHz SYSCLK (git-fixes).\n- ASoC: wm8994: fix MCLK gating for AIF clocks sourced from MCLK2 (git-fixes).\n- ASoC: wm8994: fix MCLK index used for setting MCLK rate (git-fixes).\n- ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() (git-fixes).\n- ASoC: wm8994: follow AIF clock source changes in MCLK gating (git-fixes).\n- ASoC: xilinx: formatter_pcm: Fix read-modify-write of AUD_CTRL in hw_params (git-fixes).\n- asymmetric_keys: reject trust keys without IDs (git-fixes).\n- ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 (git-fixes).\n- ata: libata-scsi: Fix ata_scsi_hotplug() reference in kernel-doc (git-fixes).\n- ata: pata_parport: fix parport attach idr_alloc for (git-fixes).\n- ata: pata_parport: Fix use-after-free in new_device_store (git-fixes).\n- ata: sata_fsl: Fix use-after-free of host_priv on probe() failure (git-fixes).\n- backlight: lm3630a: Cancel delayed work before destroying workqueue (git-fixes).\n- backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() (git-fixes).\n- backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe (git-fixes).\n- backlight: qcom-wled: Fix WLED3 brightness register stride (git-fixes).\n- Bluetooth: 6lowpan: Drain RCU readers on registration failure (git-fixes).\n- Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file (git-fixes).\n- Bluetooth: 6LoWPAN: Use RCU-safe device list removal (git-fixes).\n- Bluetooth: Add missing newline to bt_dev_{err,warn}_ratelimited() (git-fixes).\n- Bluetooth: btintel: fix buffer over-read in btintel_hw_error() (git-fixes).\n- Bluetooth: btintel: validate DDC record lengths (git-fixes).\n- Bluetooth: btqcomsmd: Convert to platform remove callback returning void (stable-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table (stable-fixes).\n- Bluetooth: hci_conn: Lock parent access during enhanced SCO setup (git-fixes).\n- Bluetooth: hci_core: free the HCI ID if naming fails (git-fixes).\n- Bluetooth: hci_core: Keep RCU protection through LTK filtering (git-fixes).\n- Bluetooth: hci_debugfs: Pin module for debugfs file operations (git-fixes).\n- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister (git-fixes).\n- Bluetooth: hci_sync: Fix inquiry cache use-after-free (git-fixes).\n- Bluetooth: hci_sync: fix mesh adv timeout units (git-fixes).\n- Bluetooth: hci_sync: Protect IRK identity reads with RCU (git-fixes).\n- Bluetooth: hci_sync: Serialize devcoredump reset during device open (git-fixes).\n- Bluetooth: hci_vhci: Pin module for debugfs file operations (git-fixes).\n- Bluetooth: ISO: Hold the listener during disconnect notification (git-fixes).\n- Bluetooth: L2CAP: hold chan in l2cap_ecred_conn_rsp() (git-fixes).\n- Bluetooth: L2CAP: hold l2cap_conn::lock in l2cap_connect_cfm() (git-fixes).\n- Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests (git-fixes).\n- Bluetooth: L2CAP: Reject mode changes on connected channels (git-fixes).\n- Bluetooth: L2CAP: Use default TxWindow for zero socket option (git-fixes).\n- Bluetooth: MGMT: Fix leaking instance on Add Extended Advertising Parameters (git-fixes).\n- Bluetooth: MGMT: Fix pending state of instances added without HCI traffic (git-fixes).\n- Bluetooth: MGMT: Reject quality report requests during unregister (git-fixes).\n- Bluetooth: msft: Lock failed probe cleanup against feature readers (git-fixes).\n- Bluetooth: RFCOMM: Fix initial port reference race (git-fixes).\n- Bluetooth: selftest: Pin module for selftest debugfs file operations (git-fixes).\n- bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port() (git-fixes).\n- bus: arm-cci: Drop CPU node reference in cci_ace_init_ports() (git-fixes).\n- bus: fsl-mc: register the object drivers after misc_class exists (git-fixes).\n- char: scx200_gpio: check cdev_add() return value (git-fixes).\n- checkpatch: skip CamelCase cache for --no-tree without root (git-fixes).\n- cifs: Pass unbyteswapped eof value into SMB2_set_eof() (git-fixes).\n- comedi: comedi_parport: validate the IRQ supplied by userspace (git-fixes).\n- comedi: dmm32at: validate the IRQ supplied by userspace (git-fixes).\n- comedi: dt2811: fix shift-out-of-bounds in IRQ check (git-fixes).\n- comedi: dt2814: validate the IRQ supplied by userspace (git-fixes).\n- comedi: ni_atmio16d: validate the IRQ supplied by userspace (git-fixes).\n- comedi: pcmmio: validate the IRQ supplied by userspace (git-fixes).\n- comedi: pcmuio: validate the IRQs supplied by userspace (git-fixes).\n- crypto: amlogic - Fix DMA memory leak in cipher error path (git-fixes).\n- crypto: amlogic - Fix IRQ handler return value and fallthrough logic (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_parse_binary (git-fixes).\n- crypto: atmel - handle authenc requests without plaintext (git-fixes).\n- crypto: atmel-aes - fix AADLENR for standalone GHASH (git-fixes).\n- crypto: atmel-sha - reject initialization without a device (git-fixes).\n- crypto: atmel-tdes - sync output bounce buffer before DMA (git-fixes).\n- crypto: atmel-tdes - zero-initialize device state (git-fixes).\n- crypto: caam - fix double-free in caam_rsa_set_priv_key_form() (git-fixes).\n- crypto: ccp - kill v3 IRQ tasklet during teardown (git-fixes).\n- crypto: ccp - kill v5 IRQ tasklet during teardown (git-fixes).\n- crypto: hisilicon/hpre - fix ECDH destination DMA mapping (git-fixes).\n- crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent (git-fixes).\n- crypto: hisilicon/hpre - fix pointer dereference before length check (git-fixes).\n- crypto: hisilicon/hpre - remove dma_free_coherent on NULL req-\u003edst in ECDH (git-fixes).\n- crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer (git-fixes).\n- crypto: qat - avoid OOB read when stripping RSA leading zeros (git-fixes).\n- crypto: qat - fix active_devs leak on crypto alg registration failure (git-fixes).\n- crypto: qat - fix use of destroyed vf2pf_lock on VF restart (git-fixes).\n- crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() (git-fixes).\n- crypto: qat - release instance on DH fallback allocation failure (git-fixes).\n- crypto: qat - zero the VF migration state buffer on save (git-fixes).\n- crypto: tcrypt - Avoid reading req-\u003ebase after submission (git-fixes).\n- dmaengine: altera-msgdma: initialize state before requesting IRQ (git-fixes).\n- dmaengine: at_hdmac: Fix use-after-free by proper tasklet cleanup (git-fixes).\n- dmaengine: bestcomm: set bcom_eng to NULL on probe failure (git-fixes).\n- dmaengine: dw-axi-dmac: convert clock handling to clk_bulk API (git-fixes).\n- dmaengine: dw-axi-dmac: Fix AXI burst length encoding (git-fixes).\n- dmaengine: dw-axi-dmac: Fix CH_CFG2 channel priority position (git-fixes).\n- dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access (git-fixes).\n- dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources (git-fixes).\n- dmaengine: fsl_raid: don't invoke client callback under desc_lock (git-fixes).\n- dmaengine: fsl_raid: zero CF descriptor pool allocations (git-fixes).\n- dmaengine: img-mdc: Fix runtime PM usage counter leak (git-fixes).\n- dmaengine: ioat: disable relaxed ordering before registering the device (git-fixes).\n- dmaengine: mediatek: hsdma: fix runtime PM leak on init failure (git-fixes).\n- dmaengine: mv_xor: kill tasklet on channel add error path (git-fixes).\n- dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr() (git-fixes).\n- dmaengine: qcom: bam_dma: Defer IRQ trigger type to device tree (git-fixes).\n- dmaengine: qcom: bam_dma: free interrupt before the clock in error path (git-fixes).\n- dmaengine: sprd: use clk_bulk API to fix clock imbalance (git-fixes).\n- dmaengine: sun6i-dma: Fix use-after-free in error handling paths (git-fixes).\n- dmaengine: xilinx_dma: Fix MCDMA descriptor fields based on DMA direction (git-fixes).\n- Documentation: rs485: Pull uart_get_rs485_mode() from serial_core.c (git-fixes).\n- Documentation: virt: Fix the struct snp_guest_request_ioctl name in sev-guest.rst (git-fixes).\n- driver core: Limit the messages on a refused uevent (git-fixes).\n- drivers/base/node: fix UAF on device_register() failure (git-fixes).\n- drm/amd/display: assign missing trace entry in amdgpu_dm_dc_clocks_state (git-fixes).\n- drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs (stable-fixes).\n- drm/amd/display: Fix swap in median3() for DSC rate control (git-fixes).\n- drm/amd/display: fix vready offset assignment in dcn_optc_lock_unlock_state (git-fixes).\n- drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG (git-fixes).\n- drm/amd/display: remove duplicated prev_p_state_change_support assignment (git-fixes).\n- drm/amd/display: take a runtime PM reference only when a CRTC turns on (git-fixes).\n- drm/amd/display: Use kcalloc() instead of kzalloc() (stable-fixes).\n- drm/amd/display: use right type for amdgpu_dc_performance event entries (git-fixes).\n- drm/amd/pm: bound SCLK FCW range entries to the table size (git-fixes).\n- drm/amdgpu/atombios: drop empty function (stable-fixes).\n- drm/amdgpu/gfx6: fix firmware leak on teardown (stable-fixes).\n- drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang (stable-fixes).\n- drm/amdgpu: Check for multiplication overflow in checkpoint stack (bsc#1276280).\n- drm/amdgpu: make Mac FB workaround generic (stable-fixes).\n- drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs (git-fixes).\n- drm/amdgpu: Remove unused amdgpu_i2c functions (stable-fixes).\n- drm/amdgpu: reset VI ASIC on MacBookPro14,3 (stable-fixes).\n- drm/amdgpu: reset VI ASIC on MacBookPro15,1 (stable-fixes).\n- drm/amdgpu: rework i2c init and fini (stable-fixes).\n- drm/amdgpu: serialize vblank counter reads against GPU reset (stable-fixes).\n- drm/amdgpu: Use dbg level for VBIOS check messages (stable-fixes).\n- drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO (git-fixes).\n- drm/amdkfd: Fix checkpoint-restore on multi-xcc (bsc#1276280).\n- drm/amdkfd: fix doorbell allocation race creating duplicate allocations (git-fixes).\n- drm/amdkfd: validate SRAT subtables before parsing (git-fixes).\n- drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties (git-fixes).\n- drm/exynos/fimd: fix register offset type in fimd_trigger() (git-fixes).\n- drm/imx/lcdc: avoid duplicate clk_per enable (git-fixes).\n- drm/komeda: Fix bits parsing of GLB_CORE_ID (git-fixes).\n- drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() (git-fixes).\n- drm/msm/a6xx: Fix secondary rail vote in ARC votes (git-fixes).\n- drm/msm/a6xx: fix use-after-free of OPP in a6xx_pm_resume (git-fixes).\n- drm/msm/dp: don't report link training success after a reinit (git-fixes).\n- drm/msm/dpu: disable the slave encoder before the master (git-fixes).\n- drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure (git-fixes).\n- drm/msm/mdp5: drop cursor pipe for msm8x76 (git-fixes).\n- drm/msm: Properly handle msm_ioremap() without name (git-fixes).\n- drm/nouveau/svm: drain fault handler before freeing svmm (git-fixes).\n- drm/nouveau: cancel the DP IRQ work before freeing the connector (git-fixes).\n- drm/nouveau: disable the fence uevent work instead of just cancelling it (git-fixes).\n- drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq (git-fixes).\n- drm/nouveau: reject zero-size notifier object allocation (git-fixes).\n- drm/omap: dsi: avoid sending bta sync all the time in writes (git-fixes).\n- drm/panel: ebbg-ft8719: Set prepare_prev_first (git-fixes).\n- drm/panfrost: Explicitly enable MMU interrupts at device init (git-fixes).\n- drm/panfrost: Prevent division by 0 (git-fixes).\n- drm/tegra: Don't pass an ERR_PTR to drm_syncobj_replace_fence() (git-fixes).\n- drm/tegra: Drop reference on postfence (git-fixes).\n- drm/tegra: Fix syncobj_in wait return value check (git-fixes).\n- drm: of: Fix drm_of_get_data_lanes_count_ep() return value documentation (git-fixes).\n- fbdev: atmel_lcdfb: Prevent FIFO work after removal (git-fixes).\n- fbdev: gxt4500: Release WC setup on probe failure (git-fixes).\n- fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: smscufx: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: ssd1307fb: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: udlfb: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use (git-fixes).\n- fbdev: xen-fbfront: check for fb_deferred_io_init() error (git-fixes).\n- firewire: cdev: Fix FW_CDEV_IOC_CREATE_ISO_CONTEXT references in kernel-doc (git-fixes).\n- firmware: cs_dsp: clear dsp-\u003erunning on the cs_dsp_run() error path (git-fixes).\n- firmware: imx: dsp: fix mailbox channel leak on kasprintf failure (git-fixes).\n- fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs (git-fixes).\n- gpio: crystalcove: add missing MODULE_ALIAS() (git-fixes).\n- gpio: davinci: Clear interrupt status in every bank on suspend (git-fixes).\n- gpio: mxc: fix both_edges bit operations (git-fixes).\n- gpio: mxc: fix wakeup_pads bit operations (git-fixes).\n- gpio: mxc: use BIT() macro (stable-fixes).\n- gpio: mxc: use lock guards for the generic GPIO chip lock (stable-fixes).\n- gpio: pca953x: Preserve wakeup accounting on parent IRQ failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Remove unsupported motion-state field from accelerometer report (git-fixes).\n- HID: amd_sfh: Use report type from request node (git-fixes).\n- HID: core: Add reserved item tag for main items (stable-fixes).\n- HID: core: Fix out-of-bounds left shift by 32 in s32ton() (git-fixes).\n- HID: cougar: reject short special-key reports (git-fixes).\n- HID: cp2112: validate response report lengths (git-fixes).\n- HID: elo: reject short touchscreen reports (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hid-steam: Make client_opened a counter (stable-fixes).\n- HID: logitech-dj: validate unnumbered keyboard reports (git-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: validate response report length (git-fixes).\n- HID: picoLCD: check for fb_deferred_io_init() error (git-fixes).\n- HID: pxrc: reject short input reports (git-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: roccat: isku: reject short button reports (git-fixes).\n- HID: roccat: koneplus: reject short button reports (git-fixes).\n- HID: roccat: konepure: reject short button reports (git-fixes).\n- HID: roccat: kovaplus: reject short button reports (git-fixes).\n- HID: roccat: pyra: reject short button reports (git-fixes).\n- HID: roccat: ryos: reject short special reports (git-fixes).\n- HID: roccat: savu: reject short special reports (git-fixes).\n- HID: wacom: fix wacom_intuos_irq NULL pen_input deref (git-fixes).\n- HID: zydacron: validate key report length (git-fixes).\n- hwmon: (coretemp) Refresh the temperature on the first read (git-fixes).\n- hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe (git-fixes).\n- hwmon: (lm70) Fix rounding of negative temperatures (git-fixes).\n- hwmon: (lm95245) Fix negative temperature conversion (git-fixes).\n- hwmon: (sht3x) Return the consumed count for heater writes (git-fixes).\n- hwrng: amd - report partial reads in non-blocking mode (git-fixes).\n- hwrng: ba431 - fix reported byte count (git-fixes).\n- hwrng: cctrng - Fix runtime PM usage counter leak (git-fixes).\n- hwrng: core - reject unknown RNG names (git-fixes).\n- hwrng: intel - return -ENOMEM when ioremap() fails (git-fixes).\n- hwrng: intel - return -ENOMEM when kmalloc_obj() fails (git-fixes).\n- hwrng: starfive - propagate clock and reset errors (git-fixes).\n- i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode() (git-fixes).\n- i2c: at91: release DMA channels when probe defers (git-fixes).\n- i2c: designware: queue only one read command for block reads (git-fixes).\n- i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len (git-fixes).\n- i2c: qcom-cci: Fix HALT_ACK reset request being dropped (git-fixes).\n- i2c: xiic: don't clobber msg-\u003elen to signal block-read completion (git-fixes).\n- i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode (stable-fixes).\n- iio: accel: adis16201: fix channel order for buffer mode (git-fixes).\n- iio: accel: kionix-kx022a: Fix IPOL macro name (git-fixes).\n- iio: accel: kxcjk-1013: Disable autosuspend on remove (git-fixes).\n- iio: accel: mma9551: disable autosuspend on remove (git-fixes).\n- iio: accel: mma9553: disable autosuspend on remove (git-fixes).\n- iio: adc: aspeed: propagate reset deassert errors (git-fixes).\n- iio: adc: aspeed: Simplify with dev_err_probe (stable-fixes).\n- iio: adc: at91-sama5d2: disable autosuspend on remove (git-fixes).\n- iio: adc: stm32: fix minimum sampling time values (git-fixes).\n- iio: adc: ti-adc128s052: validate SPI match data (git-fixes).\n- iio: core: add accessors 'masklength' (stable-fixes).\n- iio: dac: ad5758: Fix alignment for DMA safety (git-fixes).\n- iio: dac: ad5758: Fix the offset calculation (git-fixes).\n- iio: dac: ad5758: Reject out-of-range raw values (git-fixes).\n- iio: humidity: hts221: report available values via read_avail() (git-fixes).\n- iio: imu: adis16400: Check return value of spi_setup() (git-fixes).\n- iio: light: ltrf216a: Return floating point values (stable-fixes).\n- iio: pressure: dps310: fix CFG_REG bit definitions (git-fixes).\n- iio: temperature: tmp117: fix calibbias cache update on I2C write failure (git-fixes).\n- Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 (stable-fixes).\n- Input: da7280 - fix input device parent assignment (git-fixes).\n- Input: drv2665 - fix input device parent assignment (git-fixes).\n- Input: drv2667 - fix input device parent assignment (git-fixes).\n- Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 (stable-fixes).\n- Input: lkkbd - disable pending work before freeing device (stable-fixes).\n- Input: maple_keyb - fix key press detection (git-fixes).\n- Input: maplecontrol - emit EV_SYN report after reporting events (git-fixes).\n- Input: matrix-keymap - reject keycodes above KEY_MAX (git-fixes).\n- Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 (stable-fixes).\n- Input: tps6507x-ts - fix input device parent assignment (git-fixes).\n- Input: xpad - add support for Corsair Novablade Pro (stable-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kobject: fix out-of-bounds access in kobject_action_type() (git-fixes).\n- kobject: Fix the kobj_set_name reference in kset_register() kernel-doc (git-fixes).\n- KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state (git-fixes).\n- leds: flash: Prevent using uninitialized variable in flash_fault_show() (git-fixes).\n- leds: lm3692x: Fix regulator/gpio leak and wrong enabled state on last write failure (git-fixes).\n- leds: lp8860: Fix device_node leak in lp8860_probe() (git-fixes).\n- leds: pca9532: Check i2c_smbus_read_byte_data() return value (git-fixes).\n- lib/decompress_bunzip2: fix off-by-one in run-length bounds check (git-fixes).\n- lib: decompress_bunzip2: fix integer overflow in run-length decoding (git-fixes).\n- lib: validate in-memory LZ4 chunk length (git-fixes).\n- mac80211: tx: Use info-\u003eflags in ieee80211_tx_h_select_key() (git-fixes).\n- media: adv748x: Fix endpoint reference leaks on probe failure (git-fixes).\n- media: adv7180: Initialize mutex before ancillary clients (git-fixes).\n- media: adv7604: avoid negative array index in log_status when cp_read fails (git-fixes).\n- media: amphion: fix runtime PM imbalance on probe failure (git-fixes).\n- media: amphion: prevent unbind while video instances are open (git-fixes).\n- media: atmel-isi: release unregistered video device on remove (git-fixes).\n- media: au0828: Fix media device leak in au0828_usb_probe() (git-fixes).\n- media: au0828: fix use-after-free in bulk_timeout timer on disconnect (git-fixes).\n- media: au0828: Free URBs when starting DVB streaming fails (git-fixes).\n- media: cx18: Disable PCI device on probe failure (git-fixes).\n- media: cx88: Disable PCI device on MPEG initialization failure (git-fixes).\n- media: cx231xx-audio: drain wq_trigger before audio fini (git-fixes).\n- media: cx231xx: Fix cleanup path on failure (git-fixes).\n- media: cx23885: Fix use-after-free in cx23885_finidev due to race condition (git-fixes).\n- media: cx23885: unregister DVB bus when SP2 CI setup fails (git-fixes).\n- media: em28xx: fix double free in em28xx_alloc_urbs (git-fixes).\n- media: em28xx: reject audio endpoint with zero packet size (git-fixes).\n- media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler (git-fixes).\n- media: go7007: bound EZ-USB I2C transfers to the usb_buf size (git-fixes).\n- media: go7007: unregister the I2C adapter on USB probe failure (git-fixes).\n- media: gspca: use vb2_video_unregister_device() on disconnect (git-fixes).\n- media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path (git-fixes).\n- media: hantro: Disable multicore support (stable-fixes).\n- media: hantro: disable runtime PM before hardware teardown (git-fixes).\n- media: hantro: Harden MPEG-2 control access against NULL (git-fixes).\n- media: i2c: ar0521: remove duplicate media entity cleanup (git-fixes).\n- media: i2c: ov5648: Fix a data race on state-\u003estreaming (git-fixes).\n- media: i2c: ov8856: fix debug message to report actual CSI-2 lane count (git-fixes).\n- media: i2c: tc358743: add missing color-space strings (git-fixes).\n- media: imon: fix use-after-free in display_close via dev_dbg (git-fixes).\n- media: imx-jpeg: cancel timeout worker when streaming stops (git-fixes).\n- media: imx-jpeg: finish the job on device_run() error paths (git-fixes).\n- media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled (git-fixes).\n- media: ir_toy: Validate the maximum tx carrier (git-fixes).\n- media: m2m-deinterlace: fix default capture field (git-fixes).\n- media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA (git-fixes).\n- media: marvell: manage the MMP camera clock provider (git-fixes).\n- media: mediatek: jpeg: Avoid context access after job finish (git-fixes).\n- media: mediatek: jpeg: retry HW selection after successful wait (git-fixes).\n- media: mediatek: vpu: free IRQ before destroying watchdog workqueue (git-fixes).\n- media: mediatek: vpu: release reserved memory on remove (git-fixes).\n- media: meson-ir-tx: Ensure clock is disabled on unbind (git-fixes).\n- media: meson-ir-tx: Ensure probe error is propagated (git-fixes).\n- media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() (git-fixes).\n- media: meson: vdec: size capture planes from the aligned canvas (git-fixes).\n- media: microchip-csi2dc: fix async notifier leak on probe error path (git-fixes).\n- media: microchip-isc: disable histogram and flush AWB work on teardown (git-fixes).\n- media: microchip-isc: do not touch WB registers when not streaming (git-fixes).\n- media: microchip-isc: fix PM runtime leak in AWB work handler (git-fixes).\n- media: microchip-isc: synchronize the IRQ before disabling clocks on stop (git-fixes).\n- media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() (git-fixes).\n- media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() (git-fixes).\n- media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() (git-fixes).\n- media: pvrusb2: Fix USB parent device leak in class_dev_create() (git-fixes).\n- media: rc: fintek-cir: process a full RX buffer instead of overflowing it (git-fixes).\n- media: rc: mce_kbd: Fix inconsistent locking of keylock (git-fixes).\n- media: redrat3: Ensure all urbs are suspended (git-fixes).\n- media: redrat3: Ensure we don't read beyond the end of the packet (git-fixes).\n- media: redrat3: fix UAF in probe error path leaving rc device registered (git-fixes).\n- media: require two-byte Cypress type 04 records (git-fixes).\n- media: rtl28xxu: fix SDR platform device leak (git-fixes).\n- media: saa7146: Initialize interrupt lock before requesting IRQ (git-fixes).\n- media: streamzap: Add missing rc_unregister_device() (git-fixes).\n- media: stv090x: bound DiSEqC reply length to msg size (git-fixes).\n- media: stv0900: bound DiSEqC reply length to msg size (git-fixes).\n- media: tw68: balance PCI enable on cleanup (git-fixes).\n- media: tw686x: fix V4L2 device lifetime on probe failure (git-fixes).\n- media: uvcvideo: Fix NULL deref on events for uninitialized controls (git-fixes).\n- media: v4l2-ctrls: do nothing if controls == NULL in cluster functions (git-fixes).\n- media: venus: Drop session events without an instance (git-fixes).\n- media: vicodec: fix NULL deref on oversized frame (git-fixes).\n- media: vicodec: fix out-of-bounds write on under-rounded coded dimensions (git-fixes).\n- media: vicodec: make encoder CAPTURE dimensions read-only (git-fixes).\n- media: vicodec: zero-initialize stateful decoder heap buffers (git-fixes).\n- media: vidtv: fix frontend reference leak on unbind (git-fixes).\n- media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail (git-fixes).\n- media: vim2m: keep transaction buffer count stable while streaming (git-fixes).\n- media: vivid: round the height down to the vertical subsampling factor (git-fixes).\n- media: vpif_display: Fix i2c adapter reference leak in vpif_probe() (git-fixes).\n- mfd: ab8500: Fix child device leaks on probe failure (git-fixes).\n- mfd: da9150: Balance IRQ wake on teardown (git-fixes).\n- mfd: intel_quark_i2c_gpio: Manage the fixed-rate clock (git-fixes).\n- mfd: tps65217: Check return value when masking interrupt sources (git-fixes).\n- mfd: tps65217: Fix NULL pointer dereference on IRQ init failure (git-fixes).\n- mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral (git-fixes).\n- mfd: wcd934x: set DMA mask on parent to silence \"DMA mask not set\" (git-fixes).\n- misc: enclosure: fix UAF on device_register() failure (git-fixes).\n- mm, vmscan: flush tlb before large folio is freed (bsc#1250656).\n- mm: introduce num_pages_contiguous() (bsc#1284243).\n- mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() (git-fixes).\n- mtd: block: prevent reclaim I/O during request processing (git-fixes).\n- mtd: Call get_wunit() on the master partition (git-fixes).\n- mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device (git-fixes).\n- mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() (git-fixes).\n- mtd: maps: l440gx: Fix double put of the PM device in init_l440gx() (git-fixes).\n- mtd: maps: pci: balance PCI enable on cleanup (git-fixes).\n- mtd: parsers: qcom: fix offset/size overflow on large partitions (git-fixes).\n- mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() (git-fixes).\n- mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface() (git-fixes).\n- mtd: rawnand: sunxi: reject ECC maximization on small pages (git-fixes).\n- mtd: spi-nor: sfdp: check the length of the SCCR map (git-fixes).\n- mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table (git-fixes).\n- mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption (git-fixes).\n- mtd: spinand: Fix spinand_manufacturer_ops kernel-doc (git-fixes).\n- net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown (git-fixes).\n- net/rds: use clear_bit_unlock() in release_refill() (git-fixes).\n- net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll (git-fixes).\n- net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll (git-fixes).\n- net: usb: lan78xx: reject invalid EEPROM write requests (git-fixes).\n- net: usb: pegasus: check rx pkt_len against the received length (git-fixes).\n- net: usb: pegasus: do not advance rx_skb-\u003edata on dropped frames (git-fixes).\n- net: usb: r8153_ecm: reject short register reads (git-fixes).\n- net: usb: sierra_net: reject short firmware attribute reads (git-fixes).\n- net: wwan: iosm: validate msg_head before indexing msg_ring (git-fixes).\n- PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow (git-fixes).\n- PCI/P2PDMA: Gate the host bridge whitelist warning on verbose (git-fixes).\n- PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible() (git-fixes).\n- PCI/sysfs: Pass the device name length in UTF-16 code units (git-fixes).\n- PCI/sysfs: Stop reporting _DSM failures as -EPERM (git-fixes).\n- PCI: aardvark: Disable PHY on probe failures (git-fixes).\n- PCI: cadence: Preserve all error codes in cdns_plat_pcie_probe() (git-fixes).\n- PCI: Disable MSI for ULi M1575 EHCI controller (git-fixes).\n- PCI: dra7xx: Fix clock enable leak on probe failure (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Pass PF/VF number when BAR programming (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Serialize virtual PCI bus scan (git-fixes).\n- PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr() (git-fixes).\n- PCI: qcom: Honor IOMMU provider's #iommu-cells in qcom_pcie_config_sid_1_9_0() (git-fixes).\n- PCI: rockchip-host: Do not attempt 5.0 GT/s retraining (git-fixes).\n- PCI: xgene: Use managed clock for PCIe controller (git-fixes).\n- peci: aspeed: Initialize state before requesting IRQ (git-fixes).\n- phy: cadence: Sierra: Do not modify register when getting parent clock (git-fixes).\n- phy: core: Fix race-condition between _of_phy_get() and try_module_get() (git-fixes).\n- phy: HiSilicon: Fix error handling in hi3670_pcie_allclk_ctrl() (git-fixes).\n- phy: hisilicon: hi3670: Fix OF node and device reference leaks (git-fixes).\n- pinctrl: mediatek: mt7629: fix the 2.4 GHz Wi-Fi pin mode array (git-fixes).\n- pinctrl: sprd: free maps on DT map failure (git-fixes).\n- pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() (git-fixes).\n- platform/chrome: cros_ec_proto: Fix deferred response (git-fixes).\n- platform/olpc: Reserve space for a string terminator (git-fixes).\n- platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() (git-fixes).\n- platform/x86/amd: Stop counting intermediate cycles with metrics table (git-fixes).\n- platform/x86/intel-uncore-freq: Continue restoring limits on resume (git-fixes).\n- platform/x86: asus-wmi: validate custom fan curves on enable (git-fixes).\n- platform/x86: gpd pocket fan: Cancel work before releasing GPIOs (git-fixes).\n- platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() (git-fixes).\n- platform/x86: ibm_rtl: Fix potential OOB read at signature search (git-fixes).\n- platform/x86: intel_telemetry: initialize default trace verbosity (git-fixes).\n- platform/x86: msi-ec: Report valid charge thresholds when unset (git-fixes).\n- power: supply: ab8500: Preserve battery termination current (git-fixes).\n- power: supply: ab8500_btemp: Fix event temperature reporting (git-fixes).\n- power: supply: ab8500_charger: Decode AB8505 USB status (git-fixes).\n- power: supply: ab8500_charger: Fix AC charger re-enable (git-fixes).\n- power: supply: ab8500_charger: Handle detection errors (git-fixes).\n- power: supply: ab8500_charger: Recover inactive AB8505 charger (git-fixes).\n- power: supply: ab8500_charger: Respect AB8505 register layout (git-fixes).\n- power: supply: ab8500_charger: Retry AB8505 USB detection (git-fixes).\n- power: supply: ab8500_charger: Skip absent AB8505 main charger (git-fixes).\n- power: supply: ab8500_fg: Accept status from supplied power (git-fixes).\n- power: supply: ab8500_fg: Avoid reserved AB8505 CCConf bit (git-fixes).\n- power: supply: ab8500_fg: Finalize current measurements (git-fixes).\n- power: supply: ab8500_fg: Report sub-percent charge changes (git-fixes).\n- power: supply: bq2515x: Propagate charge-enable read errors (git-fixes).\n- power: supply: charger-manager: Convert to platform remove callback returning void (stable-fixes).\n- power: supply: generic-adc-battery: fix status with no supplier (git-fixes).\n- power: supply: generic-adc-battery: Propagate charged GPIO errors (git-fixes).\n- power: supply: gpio-charger: Report discharging without input power (git-fixes).\n- power: supply: lp8788-charger: Convert to platform remove callback returning void (stable-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: lp8788: Use devm_power_supply_register() helper (stable-fixes).\n- power: supply: mp2629: Use the full batt_impedance_compensation name in the ABI document (git-fixes).\n- power: supply: qcom_battmgr: report full batteries (git-fixes).\n- power: supply: qcom_battmgr: report the USB type from USB_ADAP_TYPE (git-fixes).\n- power: supply: sbs-battery: disable polling before supply teardown (git-fixes).\n- pwm: mtk-disp: Fix period readback (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- regulator: ab8500: Fix AB8505 VANA voltage selectors (git-fixes).\n- regulator: ab8500: Handle AB8505 VINTCORE selector 7 (git-fixes).\n- regulator: ab8500: Propagate mode enable read errors (git-fixes).\n- regulator: ab8500: Test dedicated enable bits only (git-fixes).\n- regulator: ab8500: Treat cut 1.0 VAUX3 as fixed (git-fixes).\n- regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() (git-fixes).\n- regulator: core: Fix coupled regulators reference leak on removal (git-fixes).\n- regulator: core: Fix rdev reference leak in regulator_resolve_supply() (git-fixes).\n- regulator: mp886x: check get_voltage_sel() return value (git-fixes).\n- regulator: mp886x: fix pontential division by zero (git-fixes).\n- regulator: mp886x: fix vsel_mask (git-fixes).\n- regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() (git-fixes).\n- Reinstate \"resource: avoid unnecessary lookups in find_next_iomem_res()\" (bsc#1284243).\n- Revert \"mkspec: Exclude rt flavor from kernel-syms dependencies\" (bsc#1244337).\n- Revert \"rpm/mkspec: Fix missing kernel-syms-rt creation\" (bsc#1244337).\n- Revert \"wifi: mac80211: do not use old MBSSID elements\" (git-fixes).\n- rtc: abx80x: fix error check after i2c_smbus_read in read_alarm() (git-fixes).\n- rtc: abx80x: properly handle shared IRQs (git-fixes).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: cmos: Disable ACPI RTC event before handling it (git-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: ds1685: arm the wake-up alarm at power-off only if an alarm is set (git-fixes).\n- rtc: ds1685: do not sleep in the power-off handler (git-fixes).\n- rtc: ftrtc010: fix integer overflow in time calculation (git-fixes).\n- rtc: mpfs: Fix alarm register word order (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: s35390a: Add missing newline to dev_err (git-fixes).\n- rtc: s35390a: Fix alarm not disabling (git-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests/alsa: Do not take another control's event as our own (git-fixes).\n- serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() (git-fixes).\n- serial: core: shut down initialized port on removal (git-fixes).\n- serial: max310x: don't clobber the TX break bit in set_termios (git-fixes).\n- serial: pmac_zilog: push received data to the port that received it (git-fixes).\n- serial: pmac_zilog: report received breaks (git-fixes).\n- slimbus: messaging: fix leaked PM vote on tid allocation failure (git-fixes).\n- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (git-fixes).\n- smb: client: use kzalloc to zero-initialize security descriptor buffer (git-fixes).\n- smb: common: change the data type of num_aces to le16 (git-fixes).\n- soc/tegra: flowctrl: Release OF node reference on error (git-fixes).\n- soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() (git-fixes).\n- soc: fsl: dpio: Fix cleanup on IRQ registration failure (git-fixes).\n- soc: fsl: dpio: Free the IRQ before releasing the I/O object (git-fixes).\n- soc: qcom: apr: clean up failed service registrations (git-fixes).\n- soc: ti: k3-ringacc: Correct ring API kernel-doc (git-fixes).\n- soc: ti: k3-ringacc: Fix DMA ring initialization kernel-doc (git-fixes).\n- soundwire: intel: initialise quirk_mask before reading it (git-fixes).\n- spi: amd: fix len==0 underflow and FIFO overflow (git-fixes).\n- spi: bcm63xx-hsspi: Disable runtime PM on remove (git-fixes).\n- spi: Fix the return value in spi_new_ancillary_device() kernel-doc (git-fixes).\n- spi: jcore: fix divide-by-zero when speed_hz is zero (git-fixes).\n- spi: mtk-nor: fix runtime PM usage count leak in probe error path (git-fixes).\n- spi: mxic: fix ps_clk leak in runtime resume (git-fixes).\n- spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer (git-fixes).\n- spi: omap2-mcspi: Remove unbalanced pm_runtime_put_sync() calls (git-fixes).\n- spi: spi-sun4i: sun4i_spi_fill_fifo(): always apply A10 FIFO fill level workaround (git-fixes).\n- spi: spi-sun4i: sun4i_spi_transfer_one(): fix transfers for SUN4I_FIFO_DEPTH (git-fixes).\n- spi: zynq-qspi: fix address buffer corruption and support 4-byte address (git-fixes).\n- staging: iio: adc: ad7816: Fix DMA safety issues in SPI transfers (git-fixes).\n- staging: media: av7110: fix corrupted BER reporting in sp8870 (git-fixes).\n- staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error (git-fixes).\n- staging: rtl8723bs: clean up redundant \u0026 parentheses (stable-fixes).\n- Staging: rtl8723bs: Delete dead code from update_current_network() (stable-fixes).\n- staging: rtl8723bs: fix buffer over-read in rtw_update_protection (git-fixes).\n- staging: rtl8723bs: fix RX buffer OOB write from device-reported length (git-fixes).\n- Staging: rtl8723bs: Remove dead code from _rtw_free_network() (stable-fixes).\n- staging: sm750fb: free cmap on framebuffer release (git-fixes).\n- thermal/drivers/sprd: validate the sensor id from the device tree (git-fixes).\n- thermal: Fix CPU mask truncation in power limit trace event (git-fixes).\n- thermal: intel: int340x: Fix temperature selection around 0 C (git-fixes).\n- thermal: intel: powerclamp: Reject invalid window_size values (git-fixes).\n- thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc (git-fixes).\n- thunderbolt: Disable CL states for the Anker Prime TB5 dock (stable-fixes).\n- thunderbolt: Do not RPM complete unrelated subtrees on unplug (git-fixes).\n- tools/thermal/tmon: Fix string truncation warning in optarg copy (git-fixes).\n- tpm: fix zero-length read discarding the pending response (git-fixes).\n- tpm: tpm_nsc: fix NULL pointer dereference on init failure (git-fixes).\n- tpm: tpm_nsc: stop using the cleanup callback as dev.release (git-fixes).\n- tty: add break_wait kernel-doc (git-fixes).\n- tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup (stable-fixes).\n- tty: vcc: zero-initialize control packet in vcc_send_ctl() (stable-fixes).\n- usb-storage: alauda: check the return value of alauda_read_map() (git-fixes).\n- usb-storage: alauda: do not do DMA from the stack (git-fixes).\n- usb-storage: alauda: fix out-of-bounds zone index (git-fixes).\n- USB: cdc-acm: fix urb leak on disconnect (git-fixes).\n- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (stable-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior (stable-fixes).\n- usb: fotg210: validate endpoint index in ep0 handlers (git-fixes).\n- usb: gadget: composite: avoid warning on aborted delayed status (git-fixes).\n- usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket (git-fixes).\n- usb: gadget: dummy_hcd: prevent unbind via sysfs (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_mass_storage: ignore class requests while inactive (git-fixes).\n- usb: gadget: f_midi: Annotate struct f_midi with __counted_by (stable-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- usb: gadget: functionfs: Factorize wait-for-endpoint code (stable-fixes).\n- USB: gadgetfs: do not WARN about excessively large memory allocations (git-fixes).\n- usb: image: microtek: stop SG processing after transfer errors (git-fixes).\n- usb: musb: da8xx: depopulate OF children on probe failure (git-fixes).\n- usb: musb: da8xx: depopulate OF children on remove (git-fixes).\n- usb: ohci-spear: disable controller wakeup on removal (git-fixes).\n- usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() (stable-fixes).\n- USB: pci-quirks: Release EHCI device reference (git-fixes).\n- USB: serial: cp210x: add Corsair AX1500i Power Supply (stable-fixes).\n- USB: serial: option: add Compal EXC-T1 support (stable-fixes).\n- USB: serial: option: add Compal EXM-G1x support (stable-fixes).\n- USB: serial: option: add Quectel EG060W (stable-fixes).\n- USB: serial: option: add Quectel RG660QB (stable-fixes).\n- USB: serial: option: add support for SIMCom SIM8260C (stable-fixes).\n- USB: serial: sierra: fix urb leak on write completion (git-fixes).\n- USB: serial: usb_wwan: fix urb leak on disconnect (git-fixes).\n- usb: typec: ucsi_ccg: Add retry mechanism in ccg_read (git-fixes).\n- USB: usbmon: fix null-ptr-deref in mon_bus_remove() when mon_bus_init() fails (git-fixes).\n- usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return() (git-fixes).\n- usbnet: fix smp_processor_id() use in preemptible context (git-fixes).\n- vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() (bsc#1284243).\n- vfio/type1: conditional rescheduling while pinning (bsc#1284243).\n- vfio/type1: introduce a new member has_rsvd for struct vfio_dma (bsc#1284243).\n- vfio/type1: optimize vfio_pin_pages_remote() (bsc#1284243).\n- vfio/type1: optimize vfio_unpin_pages_remote() (bsc#1284243).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: mediatek: Apply the driver's mode to a watchdog left running (git-fixes).\n- wifi: ath6kl: don't take RTNL in del_virtual_intf (git-fixes).\n- wifi: ath9k: delete channel-context timers on deinit (git-fixes).\n- wifi: ath10k: avoid IDR mutation during TX cleanup (git-fixes).\n- wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup (git-fixes).\n- wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).\n- wifi: ath11k: disable interrupts during firmware crash recovery (git-fixes).\n- wifi: ath11k: fix locking problem in ath11k_dp_rx_tid_del_func() (git-fixes).\n- wifi: ath11k: fix NULL dereference in ahb remove when QMI init incomplete (git-fixes).\n- wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() (git-fixes).\n- wifi: ath11k: fix sporadic WLAN initialization failures (git-fixes).\n- wifi: ath11k: fix unbalanced IRQ enable/disable during suspend/resume (git-fixes).\n- wifi: ath11k: modify null check logic in ath11k_ce_rx_post_pipe() (git-fixes).\n- wifi: ath11k: reset ar-\u003enum_stations on hardware start (git-fixes).\n- wifi: ath11k: unregister PM notifier on QMI init failure path (git-fixes).\n- wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).\n- wifi: ath12k: fix incorrect TID updation in DP monitor status path (stable-fixes).\n- wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info (stable-fixes).\n- wifi: ath12k: fix the fetching of combined rssi (git-fixes).\n- wifi: ath12k: Free allocated CE IRQs on request_irq() failure (git-fixes).\n- wifi: b43: don't pass unterminated string to sscanf() (git-fixes).\n- wifi: b43: fix use-after-free in b43_bcma_remove() (git-fixes).\n- wifi: b43legacy: debugfs: NUL terminate string in debugfs (git-fixes).\n- wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz (git-fixes).\n- wifi: carl9170: NUL terminate string in debugfs (git-fixes).\n- wifi: cfg80211: allow zero HE OBSS PD offsets (git-fixes).\n- wifi: cfg80211: preserve hidden-group beacon IE ownership (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: track SSID regardless of country data (git-fixes).\n- wifi: cw1200: fix TX padding OOB read leaking heap data to device (git-fixes).\n- wifi: iwlegacy: 3945: free EEPROM data on remove (git-fixes).\n- wifi: iwlwifi: dvm: pair transport op-mode enter/leave (stable-fixes).\n- wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp* (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: mac80211: account proxy paths against the mesh path limit (git-fixes).\n- wifi: mac80211: Add 802.3 multicast encapsulation offload support (stable-fixes).\n- wifi: mac80211: Add multicast to unicast support for 802.3 path (stable-fixes).\n- wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() (stable-fixes).\n- wifi: mac80211: clear fragment cache entry 'is_protected' (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't reset the TXQ scheduling round number (git-fixes).\n- wifi: mac80211: don't send encap offload frames unencrypted (git-fixes).\n- wifi: mac80211: drain PS delivery work during station teardown (git-fixes).\n- wifi: mac80211: drop encap offload frames with a tainted key (git-fixes).\n- wifi: mac80211: Fix a race when expiring a mesh path (git-fixes).\n- wifi: mac80211: fix encryption tailroom (git-fixes).\n- wifi: mac80211: fix key selection for encap offload frames (git-fixes).\n- wifi: mac80211: fix mesh fast xmit path deletion UAF (git-fixes).\n- wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (stable-fixes).\n- wifi: mac80211: fix swapped fq_overlimit/fq_overmemory in aqm debugfs (git-fixes).\n- wifi: mac80211: Fix the return value in mesh_path_add() kernel-doc (git-fixes).\n- wifi: mac80211: fix unauthorised port check for encap offload (git-fixes).\n- wifi: mac80211: handle empty FILS association request payload (git-fixes).\n- wifi: mac80211: init radiotap iter after length checks (git-fixes).\n- wifi: mac80211: kill wake_txqs_tasklet on unregistration (git-fixes).\n- wifi: mac80211: limit injected HT/VHT MCSes (git-fixes).\n- wifi: mac80211: mesh: use hlist_add_head_rcu() (git-fixes).\n- wifi: mac80211: minstrel_ht: validate fixed rate index (git-fixes).\n- wifi: mac80211: prevent AP VLAN tx from other interfaces (git-fixes).\n- wifi: mac80211: refactor populating mesh related fields in sinfo (stable-fixes).\n- wifi: mac80211: release mesh path quota on failed additions (git-fixes).\n- wifi: mac80211: reserve MME tailroom for protected beacons (git-fixes).\n- wifi: mac80211: set info-\u003eband for 802.3 encap offload frames (git-fixes).\n- wifi: mac80211: use link address as TA for non-MLO 4-addr station on MLD AP (git-fixes).\n- wifi: mt76: feed the station RSSI average from the chain signals (git-fixes).\n- wifi: mt76: fix memory leak in USB TX path (git-fixes).\n- wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() (git-fixes).\n- wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add() (git-fixes).\n- wifi: mt76: fix wcid-\u003epktid corruption in mt76_wcid_cleanup() (git-fixes).\n- wifi: mt76: mt76x02: validate RX padding before use (git-fixes).\n- wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff (git-fixes).\n- wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory (git-fixes).\n- wifi: mt76: mt7603: don't drop short frames looped back on PS entry (git-fixes).\n- wifi: mt76: mt7615: cancel reset work during unregister (git-fixes).\n- wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs (git-fixes).\n- wifi: mt76: mt7615: read MT7663 temperature from the correct offset (git-fixes).\n- wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy (git-fixes).\n- wifi: mt76: mt7615: validate MCU response lengths (git-fixes).\n- wifi: mt76: mt7915: allocate vif wcid in the same range as stations (stable-fixes).\n- wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (git-fixes).\n- wifi: mt76: mt7915: check default EEPROM firmware size before copying (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() (git-fixes).\n- wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump (git-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure (git-fixes).\n- wifi: mt76: mt7921: check drv_pmctrl return in the PCIe reset path (git-fixes).\n- wifi: mt76: mt7921: fix lock inversion between dev-\u003emutex and iflist_mtx (git-fixes).\n- wifi: mt76: mt7921: fix the lock inversion in suspend and resume (git-fixes).\n- wifi: mt76: mt7925: check drv_pmctrl return in the PCIe reset path (git-fixes).\n- wifi: mt76: mt7925: fix lock inversion between dev-\u003emutex and iflist_mtx (git-fixes).\n- wifi: mt76: mt7925: fix the lock inversion in suspend and resume (git-fixes).\n- wifi: mt76: mt7925: honour mac80211's FIF_FCSFAIL instead of hardcoding drop_err (git-fixes).\n- wifi: mt76: mt7925: restore the reset state when fw_pmctrl fails (git-fixes).\n- wifi: mt76: mt7996: fix PLE free page and AC queue register offsets (git-fixes).\n- wifi: mt76: mt7996: validate firmware event lengths before parsing (git-fixes).\n- wifi: mt76: usb: fix source overread in mt76u_copy (git-fixes).\n- wifi: mwifiex: append hotfix number to firmware version string (git-fixes).\n- wifi: p54: validate firmware record lengths (stable-fixes).\n- wifi: rtw88: debugfs: don't vzalloc(0) when rsvd_page is read unconfigured (git-fixes).\n- wifi: rtw88: debugfs: support multiple adapters debugging (stable-fixes).\n- wifi: rtw88: fix out-of-bounds CAM write when key table is full (git-fixes).\n- wifi: rtw88: sdio: zero the padding added to a TX transfer (git-fixes).\n- wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields (git-fixes).\n- wifi: rtw89: cap firmware section_num before parsing (git-fixes).\n- wifi: wfx: fix possible device hang during init (git-fixes).\n- wifi: wfx: fix use-after-free of the cooling work on device removal (git-fixes).\n- wifi: wfx: validate MIB read length before copying to caller (git-fixes).\n- wwan: wwan_hwsim: Pin module for debugfs file operations (git-fixes).\n- xhci: dbc: lock the minor IDR on registration failure (git-fixes).\n","status":"published","published":"2026-11-03T19:25:57Z","modified":"2026-11-06T17:23:11.195914364Z","updated_at":"2026-11-06T18:05:03.243497Z"},{"id":"SUSE-SU-2026:5091-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).\n- CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).\n- CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).\n- CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).\n- CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).\n- CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).\n- CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).\n- CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).\n- CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).\n- CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).\n- CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).\n- CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).\n- CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).\n- CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).\n- CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).\n- CVE-2026-72110: bpf,fork: wipe -\u003ebpf_storage before bailouts that access it (bsc#1277357).\n- CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).\n- CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).\n- CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).\n- CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).\n- CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).\n- CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).\n- CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).\n- CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).\n- CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).\n- CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).\n- CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).\n- CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).\n- CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).\n- CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).\n- CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).\n- CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).\n- CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).\n- CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).\n- CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).\n- CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).\n- CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).\n- CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).\n- CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).\n- CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).\n- CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (bsc#1279494).\n- CVE-2026-80881: ocfs2: fix buffer head management in ocfs2_read_blocks() (bsc#1279496).\n- CVE-2026-80978: ip6_gre: fix hardware header length for NBMA tunnels (bsc#1280253).\n- CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (bsc#1280472).\n- CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler (bsc#1280520).\n- CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler (bsc#1280569).\n- CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (bsc#1280713).\n- CVE-2026-89560: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (bsc#1280806).\n- CVE-2026-89595: fsnotify: Fix stale object mask after concurrent mark updates (bsc#1280834).\n- CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826).\n- CVE-2026-89637: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (bsc#1280492).\n- CVE-2026-89649: ceph: bound xattr value length in __build_xattrs() (bsc#1280434).\n- CVE-2026-89654: ceph: fix UAF in check_new_map() on session freed during unlock (bsc#1280415).\n- CVE-2026-89655: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (bsc#1280398).\n- CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563).\n- CVE-2026-89657: libceph: validate OSD extent maps before cursor advance (bsc#1280545).\n- CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling (bsc#1280822).\n- CVE-2026-89761: apparmor: fix out-of-bounds write when null terminating a label vec (bsc#1280745).\n- CVE-2026-89786: ext4: fix out-of-bounds read in ext4_read_inline_dir() (bsc#1280976).\n- CVE-2026-89787: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (bsc#1280977).\n- CVE-2026-90042: ceph: properly decrypt filenames in vmalloc() buffers (bsc#1280948).\n- CVE-2026-90092: Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (bsc#1281384).\n- CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (bsc#1281577).\n- CVE-2026-90148: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (bsc#1281551).\n- CVE-2026-90227: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (bsc#1281705).\n- CVE-2026-90393: bpf: Fix potential UAF in bpf_netns_link_update_prog (bsc#1282289).\n- CVE-2026-93054: uio: Fix stale info pointer in failed registration path (bsc#1282276).\n- CVE-2026-93228: svcrdma: Reject Write/Reply chunks with segcount 0 (bsc#1282697).\n- CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush() (bsc#1283004).\n- CVE-2026-93795: blk-cgroup: fix leaks and online flag on radix_tree_insert failure (bsc#1283155).\n- CVE-2026-93798: btrfs: fix reloc root cleanup in merge_reloc_roots() (bsc#1282769).\n- CVE-2026-93817: perf: Fix addr_filter_ranges lifetime (bsc#1283017).\n- CVE-2026-97575: media: v4l2-ctrls: validate AV1 tile counts (bsc#1283337).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97926: ufs: validate cylinder group metadata before caching it (bsc#1283887).\n- CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).\n- CVE-2026-98086: ALSA: ump: do not touch legacy_rmidi before it exists (bsc#1283785).\n- CVE-2026-98264: ALSA: virtio: reset device before deleting virtqueues (bsc#1284363).\n- CVE-2026-98306: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (bsc#1284505).\n- CVE-2026-98368: esp: downgrade zerocopy managed frags before mutating skb frags (bsc#1284498).\n- CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (bsc#1284740).\n- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).\n- CVE-2026-98471: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (bsc#1286240).\n\nThe following non security issues were fixed:\n\n- accel/qaic: reject BO sizes that overflow page count (git-fixes).\n- ACPI: CPPC: Validate the _CPC package header (git-fixes).\n- ACPI: extlog: Validate elog record length before walking sections (git-fixes).\n- ACPI: PCI: pci_link: clear driver_data before free (git-fixes).\n- ACPI: pfr_update: zero-initialize capability query result (git-fixes).\n- ACPI: PM: Drop parent state update from acpi_device_get_power() (git-fixes).\n- ACPI: tables: handle failed initrd override mappings (git-fixes).\n- ACPI: TAD: Rearrange RT data validation checking (stable-fixes).\n- ACPI: video: Fix backlight unregistration ordering (git-fixes).\n- ACPICA: Fix memory leak in acpi_ds_create_field() (git-fixes).\n- ACPICA: Fix PCC OperationRegion command offsets (git-fixes).\n- ALSA: 6fire: take stream_mutex in the Digital Thru control (git-fixes).\n- ALSA: aloop: Keep the timer source alive until card release (git-fixes).\n- ALSA: caiaq: Allow zero-length packet handling for EP1 (git-fixes).\n- ALSA: caiaq: Fix races at MIDI URB and trigger accesses (git-fixes).\n- ALSA: caiaq: Fix the Kore controller key map (git-fixes).\n- ALSA: caiaq: Register card at the final step (git-fixes).\n- ALSA: caiaq: Serialize access to the EP1 command buffer (git-fixes).\n- ALSA: compress: add missing OPEN-state gate to SET_METADATA (git-fixes).\n- ALSA: compress: fix buffer leak on failed SET_PARAMS (git-fixes).\n- ALSA: compress: reject buffer geometry change on gapless next_track (git-fixes).\n- ALSA: control: Fix virtual master creation reference in kernel-doc (git-fixes).\n- ALSA: cs46xx: fix unit mismatch in DSP code area bounds check (git-fixes).\n- ALSA: hda/hdmi: clamp num_cvts against cvt_nids in hdmi_read_pin_conn (git-fixes).\n- ALSA: hda/hdmi: clamp sad_count in ELD proc write handler (git-fixes).\n- ALSA: hda: Add NULL check for the driver pointer at unsol event work (git-fixes).\n- ALSA: hda: Avoid non-operational GPU warning at regular device removal (git-fixes).\n- ALSA: hda: Fix potential UAF for gating jack (git-fixes).\n- ALSA: hda: intel: Cancel delayed work at shutdown, too (git-fixes).\n- ALSA: info: Fix memory leak at card removal (git-fixes).\n- ALSA: jack: Fix kctl free at error in snd_jack_kctl_new() (git-fixes).\n- ALSA: jack: Remove debugfs before freeing unregistered jacks (git-fixes).\n- ALSA: line6: Clear prev_fbuf on capture buffer release (git-fixes).\n- ALSA: line6: Fix potential OOB write in line6_capture_copy() (git-fixes).\n- ALSA: line6: Reject too small max packet sizes (git-fixes).\n- ALSA: line6: Use kzalloc() for PCM buffer allocation (git-fixes).\n- ALSA: pcm: Fix driver_tstamp value reporting (git-fixes).\n- ALSA: pcm: Protect channel-map reads against runtime detach (git-fixes).\n- ALSA: pcm: Protect delay DMA sync against concurrent HW_FREE (git-fixes).\n- ALSA: pcm: Protect delay DMA sync in forward and rewind, too (git-fixes).\n- ALSA: pcm: Protect the unregister notifier traversal (git-fixes).\n- ALSA: pcm: Remove channel-map controls before freeing substreams (git-fixes).\n- ALSA: pcm: Unlink substreams before releasing them (git-fixes).\n- ALSA: rawmidi: Drain input work before freeing the runtime (git-fixes).\n- ALSA: seq: Fix missing direction and ump_group handling in 32bit compat ioctl (git-fixes).\n- ALSA: seq: oss: Skip events until fully initialized (git-fixes).\n- ALSA: ump: Avoid dereference with max_src_size=0 (git-fixes).\n- ALSA: ump: Correct return size of fill_rpn() (git-fixes).\n- ALSA: usb-audio: Use fixed control index for us16x08 mixer elements (git-fixes).\n- ALSA: via82xx: use helper to activate DXS controls (git-fixes).\n- ALSA: vmaster: Protect follower lookup and setup (git-fixes).\n- ASoC: adau17x1: return cache sync errors from resume (git-fixes).\n- ASoC: ak4642: return cache sync errors from resume (git-fixes).\n- ASoC: amd: acp: Fix .close() being skipped on rollback (git-fixes).\n- ASoC: amd: ps: Fix acp63_pdm_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: ps: Fix acp63_sdw_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: raven: Fix acp3x_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: renoir: Fix acp_pdm_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: vangogh: Fix acp5x_dma_close() being skipped on rollback (git-fixes).\n- ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) (stable-fixes).\n- ASoC: amd: yc: Fix acp6x_pdm_dma_close() being skipped on rollback (git-fixes).\n- ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() (git-fixes).\n- ASoC: atmel-i2s: fix MCK generator error handling (git-fixes).\n- ASoC: atmel-i2s: use optional API for gclk (git-fixes).\n- ASoC: atmel-i2s: use optional API for muxclk (git-fixes).\n- ASoC: atmel: atmel-pcm-pdc: Fix atmel_pcm_close() being skipped on rollback (git-fixes).\n- ASoC: codecs: da732x: Fix definition of ADC2 EQ Overall Volume control (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ (git-fixes).\n- ASoC: codecs: rt5659: propagate GPIO errors (git-fixes).\n- ASoC: codecs: rt5682s: disable jack detection work on shutdown (git-fixes).\n- ASoC: codecs: sta32x: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).\n- ASoC: codecs: sta32x: Fix definition of limiter threshold controls (git-fixes).\n- ASoC: codecs: sta350: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).\n- ASoC: codecs: sta350: Fix definition of limiter threshold controls (git-fixes).\n- ASoC: codecs: tlv320adc3xxx: Fix definition of AGC Target Level control (git-fixes).\n- ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() (git-fixes).\n- ASoC: codecs: wm5100: Fix definition of EQ3 Band 1 Volume control (git-fixes).\n- ASoC: codecs: wm8510: Fix definition of ADC Inversion Switch control (git-fixes).\n- ASoC: codecs: wm8737: Fix definition of zero cross switches (git-fixes).\n- ASoC: codecs: wm8750: Fix definition of ALC Capture NG Type control (git-fixes).\n- ASoC: codecs: wm8955: Fix definition of Treble Cutoff control (git-fixes).\n- ASoC: codecs: wm8983: Fix definition of ADC 128x Oversampling control (git-fixes).\n- ASoC: codecs: wm8985: Fix definition of ADC 128x Oversampling control (git-fixes).\n- ASoC: codecs: wm8990: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).\n- ASoC: codecs: wm8990: Fix definition of right input PGA controls (git-fixes).\n- ASoC: codecs: wm8991: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).\n- ASoC: codecs: wm8991: Fix definition of right input PGA controls (git-fixes).\n- ASoC: codecs: wm8994: Fix definition of WM8958 noise gate hold time controls (git-fixes).\n- ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() (git-fixes).\n- ASoC: codecs: wm_hubs: Fix definition of MIXINR to MIXOUTR volume control (git-fixes).\n- ASoC: dwc: Use OF match data again for StarFive JH7110 (git-fixes).\n- ASoC: es8316: return cache sync errors from resume (git-fixes).\n- ASoC: es8326: report resume restore errors (git-fixes).\n- ASoC: fsl_asrc: check the second front-end DMA channel (git-fixes).\n- ASoC: fsl_asrc: use regmap_write_bits to update clock source registers (git-fixes).\n- ASoC: imx-pcm-rpmsg: Fix imx_rpmsg_pcm_close() being skipped on rollback (git-fixes).\n- ASoC: intel: atom: Fix .shutdown() being skipped on rollback (git-fixes).\n- ASoC: Intel: atom: Fix platform device leak on probe failure (git-fixes).\n- ASoC: Intel: avs: Prevent module info underflow (git-fixes).\n- ASoC: Intel: avs: Unprepare a stream when recovery occurs (git-fixes).\n- ASoC: mediatek: common: Handle constraint return value in FE startup (git-fixes).\n- ASoC: mediatek: common: Keep codec references until the card is bound (git-fixes).\n- ASoC: mediatek: mt6797: fix wrong unwind order and error code in enable_clock (git-fixes).\n- ASoC: mediatek: mt8183: Fix APLL enable error handling (git-fixes).\n- ASoC: mediatek: mt8183: Fix clock handling in mux disable path (git-fixes).\n- ASoC: mediatek: mt8183: Fix wrong clock cleanup on clk_set_parent() failure (git-fixes).\n- ASoC: mediatek: mt8186: Fix AFE clock error handling (git-fixes).\n- ASoC: mediatek: mt8186: Fix APLL enable error handling (git-fixes).\n- ASoC: mediatek: mt8186: Fix APLL mux setting error handling (git-fixes).\n- ASoC: mediatek: mt8186: Fix clock handling in mux disable path (git-fixes).\n- ASoC: mediatek: mt8186: Fix MCK error handling (git-fixes).\n- ASoC: mediatek: mt8188: Handle constraint return value in FE startup (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-clk: Handle clock enable errors (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-clk: Handle tuner clock enable errors (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-clk: Propagate regmap update errors (git-fixes).\n- ASoC: mediatek: mt8188: mt8188-afe-pcm: Handle runtime resume errors (git-fixes).\n- ASoC: mediatek: mt8192-mt6359: Fix error handling in MTKAIF calibration (git-fixes).\n- ASoC: mediatek: mt8192: check return values in mt8192_afe_gpio_init() (git-fixes).\n- ASoC: mediatek: mt8192: fix AFE clock error handling (git-fixes).\n- ASoC: mediatek: mt8192: fix APLL mux error handling (git-fixes).\n- ASoC: mediatek: mt8192: fix error handling in APLL enable functions (git-fixes).\n- ASoC: mediatek: mt8192: fix MCK clock error handling (git-fixes).\n- ASoC: mediatek: mt8192: Handle regcache_sync() failure in runtime resume (git-fixes).\n- ASoC: mediatek: mt8192: Propagate errors in I2S DAI DAPM event handlers (git-fixes).\n- ASoC: mediatek: mt8192: Propagate errors in TDM DAI DAPM event handlers (git-fixes).\n- ASoC: mediatek: mt8192: Propagate mt8192_afe_gpio_request() errors in ADDA DAI (git-fixes).\n- ASoC: mediatek: mt8192: switch to devm_clk_get_optional() (git-fixes).\n- ASoC: mediatek: mt8195: Check paired MEMIF clock enable in FE trigger (git-fixes).\n- ASoC: mediatek: mt8195: Fix ETDM MCLK error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix ETDM probe error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix ETDM startup error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix FE startup error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix HDMI TX startup error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix main clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix paired memif clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix register access clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix runtime resume error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix timing system clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Fix tuner clock error handling (git-fixes).\n- ASoC: mediatek: mt8195: Propagate IRQ lookup errors (git-fixes).\n- ASoC: mt6359-accdet: manage private workqueues with devres (git-fixes).\n- ASoC: nau8540: return cache sync errors from resume (git-fixes).\n- ASoC: ops: Fix return value in snd_soc_limit_volume() (git-fixes).\n- ASoC: qcom: q6apm: clear g_apm on driver removal (git-fixes).\n- ASoC: qcom: q6apm: reset the hw pointer with the fragment queue (git-fixes).\n- ASoC: rockchip: rockchip_i2s: Handle runtime PM resume failures in set_fmt (git-fixes).\n- ASoC: rt711-sdca: always cancel jack work on remove (git-fixes).\n- ASoC: rt711-sdw: always cancel jack work on remove (git-fixes).\n- ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls (git-fixes).\n- ASoC: rt712-sdca: always cancel jack work on remove (git-fixes).\n- ASoC: rt722-sdca: always cancel jack work on remove (git-fixes).\n- ASoC: rt1011: return cache sync errors from resume (git-fixes).\n- ASoC: rt1016: return cache sync errors from resume (git-fixes).\n- ASoC: rt1305: return cache sync errors from resume (git-fixes).\n- ASoC: rt1308: return cache sync errors from resume (git-fixes).\n- ASoC: rt5616: return cache sync errors from resume (git-fixes).\n- ASoC: rt5659: return cache sync errors from resume (git-fixes).\n- ASoC: rt5660: return cache sync errors from resume (git-fixes).\n- ASoC: rt5665: return cache sync errors from resume (git-fixes).\n- ASoC: rt5682-sdw: always cancel jack work on remove (git-fixes).\n- ASoC: soc-ac97: Fix error handling in snd_soc_new_ac97_component() (git-fixes).\n- ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer() (git-fixes).\n- ASoC: soc-topology-test: Check return value of kunit_device_register() (git-fixes).\n- ASoC: SOF: amd: fix amd_sof_acp_remove() teardown ordering (git-fixes).\n- ASoC: SOF: imx: Prevent stack OOB read in DSP panic dump (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() (git-fixes).\n- ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() (git-fixes).\n- ASoC: wcd-mbhc-v2: Fix incorrect properties names and typos (git-fixes).\n- ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() (git-fixes).\n- asymmetric_keys: reject trust keys without IDs (git-fixes).\n- ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 (git-fixes).\n- ata: libata-scsi: Fix ata_scsi_hotplug() reference in kernel-doc (git-fixes).\n- ata: pata_parport: fix parport attach idr_alloc for (git-fixes).\n- ata: pata_parport: Fix use-after-free in new_device_store (git-fixes).\n- ata: sata_fsl: Fix use-after-free of host_priv on probe() failure (git-fixes).\n- backlight: lm3630a: Cancel delayed work before destroying workqueue (git-fixes).\n- backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() (git-fixes).\n- backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe (git-fixes).\n- backlight: qcom-wled: Fix WLED3 brightness register stride (git-fixes).\n- Bluetooth: 6lowpan: Drain RCU readers on registration failure (git-fixes).\n- Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file (git-fixes).\n- Bluetooth: 6LoWPAN: Use RCU-safe device list removal (git-fixes).\n- Bluetooth: Add missing newline to bt_dev_{err,warn}_ratelimited() (git-fixes).\n- Bluetooth: btintel: fix buffer over-read in btintel_hw_error() (git-fixes).\n- Bluetooth: btintel: validate DDC record lengths (git-fixes).\n- Bluetooth: btmtk: fix skb double free on ISO padding failure (git-fixes).\n- Bluetooth: btqcomsmd: Convert to platform remove callback returning void (stable-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table (stable-fixes).\n- Bluetooth: hci_conn: Lock parent access during enhanced SCO setup (git-fixes).\n- Bluetooth: hci_core: free the HCI ID if naming fails (git-fixes).\n- Bluetooth: hci_core: Keep RCU protection through LTK filtering (git-fixes).\n- Bluetooth: hci_debugfs: Pin module for debugfs file operations (git-fixes).\n- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister (git-fixes).\n- Bluetooth: hci_sync: Fix inquiry cache use-after-free (git-fixes).\n- Bluetooth: hci_sync: fix mesh adv timeout units (git-fixes).\n- Bluetooth: hci_sync: Protect IRK identity reads with RCU (git-fixes).\n- Bluetooth: hci_sync: Serialize devcoredump reset during device open (git-fixes).\n- Bluetooth: hci_vhci: Pin module for debugfs file operations (git-fixes).\n- Bluetooth: ISO: Hold the listener during disconnect notification (git-fixes).\n- Bluetooth: L2CAP: hold chan in l2cap_ecred_conn_rsp() (git-fixes).\n- Bluetooth: L2CAP: hold l2cap_conn::lock in l2cap_connect_cfm() (git-fixes).\n- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn (git-fixes).\n- Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests (git-fixes).\n- Bluetooth: L2CAP: Reject mode changes on connected channels (git-fixes).\n- Bluetooth: L2CAP: Use default TxWindow for zero socket option (git-fixes).\n- Bluetooth: MGMT: Fix leaking instance on Add Extended Advertising Parameters (git-fixes).\n- Bluetooth: MGMT: Fix pending state of instances added without HCI traffic (git-fixes).\n- Bluetooth: MGMT: Reject quality report requests during unregister (git-fixes).\n- Bluetooth: msft: Lock failed probe cleanup against feature readers (git-fixes).\n- Bluetooth: MSFT: Serialize handle map cleanup with event processing (git-fixes).\n- Bluetooth: RFCOMM: Fix initial port reference race (git-fixes).\n- Bluetooth: selftest: Pin module for selftest debugfs file operations (git-fixes).\n- bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port() (git-fixes).\n- bus: arm-cci: Drop CPU node reference in cci_ace_init_ports() (git-fixes).\n- bus: fsl-mc: register the object drivers after misc_class exists (git-fixes).\n- char: scx200_gpio: check cdev_add() return value (git-fixes).\n- comedi: comedi_parport: validate the IRQ supplied by userspace (git-fixes).\n- comedi: dmm32at: validate the IRQ supplied by userspace (git-fixes).\n- comedi: dt2811: fix shift-out-of-bounds in IRQ check (git-fixes).\n- comedi: dt2814: validate the IRQ supplied by userspace (git-fixes).\n- comedi: ni_atmio16d: validate the IRQ supplied by userspace (git-fixes).\n- comedi: pcmmio: validate the IRQ supplied by userspace (git-fixes).\n- comedi: pcmuio: validate the IRQs supplied by userspace (git-fixes).\n- crypto: amlogic - Fix DMA memory leak in cipher error path (git-fixes).\n- crypto: amlogic - Fix IRQ handler return value and fallthrough logic (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_parse_binary (git-fixes).\n- crypto: atmel - handle authenc requests without plaintext (git-fixes).\n- crypto: atmel-aes - fix AADLENR for standalone GHASH (git-fixes).\n- crypto: atmel-sha - reject initialization without a device (git-fixes).\n- crypto: atmel-tdes - sync output bounce buffer before DMA (git-fixes).\n- crypto: atmel-tdes - zero-initialize device state (git-fixes).\n- crypto: caam - fix double-free in caam_rsa_set_priv_key_form() (git-fixes).\n- crypto: ccp - kill v3 IRQ tasklet during teardown (git-fixes).\n- crypto: ccp - kill v5 IRQ tasklet during teardown (git-fixes).\n- crypto: hisilicon/hpre - fix ECDH destination DMA mapping (git-fixes).\n- crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent (git-fixes).\n- crypto: hisilicon/hpre - fix pointer dereference before length check (git-fixes).\n- crypto: hisilicon/hpre - remove dma_free_coherent on NULL req-\u003edst in ECDH (git-fixes).\n- crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer (git-fixes).\n- crypto: qat - avoid OOB read when stripping RSA leading zeros (git-fixes).\n- crypto: qat - fix active_devs leak on crypto alg registration failure (git-fixes).\n- crypto: qat - fix use of destroyed vf2pf_lock on VF restart (git-fixes).\n- crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() (git-fixes).\n- crypto: qat - release instance on DH fallback allocation failure (git-fixes).\n- crypto: qat - zero the VF migration state buffer on save (git-fixes).\n- crypto: tcrypt - Avoid reading req-\u003ebase after submission (git-fixes).\n- Documentation: rs485: Pull uart_get_rs485_mode() from serial_core.c (git-fixes).\n- Documentation: virt: Fix the struct snp_guest_request_ioctl name in sev-guest.rst (git-fixes).\n- drivers/base/node: fix UAF on device_register() failure (git-fixes).\n- Drivers: hv: vmbus: add VTL2 redirect connection ID (git-fixes).\n- drm/amd/display: assign missing trace entry in amdgpu_dm_dc_clocks_state (git-fixes).\n- drm/amd/display: disable replay when crc source is enabled (stable-fixes).\n- drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs (stable-fixes).\n- drm/amd/display: fix vready offset assignment in dcn_optc_lock_unlock_state (git-fixes).\n- drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG (git-fixes).\n- drm/amd/display: remove duplicated prev_p_state_change_support assignment (git-fixes).\n- drm/amd/display: Use kcalloc() instead of kzalloc() (stable-fixes).\n- drm/amd/display: use right type for amdgpu_dc_performance event entries (git-fixes).\n- drm/amd/pm: bound SCLK FCW range entries to the table size (git-fixes).\n- drm/amdgpu/atombios: drop empty function (stable-fixes).\n- drm/amdgpu/gfx6: fix firmware leak on teardown (stable-fixes).\n- drm/amdgpu: Check for multiplication overflow in checkpoint stack (bsc#1276280).\n- drm/amdgpu: make Mac FB workaround generic (stable-fixes).\n- drm/amdgpu: Remove unused amdgpu_i2c functions (stable-fixes).\n- drm/amdgpu: reset VI ASIC on MacBookPro14,3 (stable-fixes).\n- drm/amdgpu: reset VI ASIC on MacBookPro15,1 (stable-fixes).\n- drm/amdgpu: rework i2c init and fini (stable-fixes).\n- drm/amdgpu: serialize vblank counter reads against GPU reset (stable-fixes).\n- drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support (stable-fixes).\n- drm/amdgpu: Use dbg level for VBIOS check messages (stable-fixes).\n- drm/amdkfd: Fix checkpoint-restore on multi-xcc (bsc#1276280).\n- drm/amdkfd: Fix partial migrate issue (stable-fixes).\n- drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties (git-fixes).\n- drm/exynos/fimd: fix register offset type in fimd_trigger() (git-fixes).\n- drm/i915/display: convert I915_STATE_WARN() to struct intel_display (stable-fixes).\n- drm/i915/gmbus: convert to struct intel_display (stable-fixes).\n- drm/i915/vga: Convert VGA code to intel_display (stable-fixes).\n- drm/i915: document range_overflows() and range_end_overflows() macros (stable-fixes).\n- drm/i915: rename range_overflows_end() to range_end_overflows() (stable-fixes).\n- drm/imx/lcdc: avoid duplicate clk_per enable (git-fixes).\n- drm/komeda: Fix bits parsing of GLB_CORE_ID (git-fixes).\n- drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() (git-fixes).\n- drm/msm/a6xx: Fix secondary rail vote in ARC votes (git-fixes).\n- drm/msm/a6xx: fix use-after-free of OPP in a6xx_pm_resume (git-fixes).\n- drm/msm/dp: don't report link training success after a reinit (git-fixes).\n- drm/msm/dpu: disable the slave encoder before the master (git-fixes).\n- drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure (git-fixes).\n- drm/msm/mdp5: drop cursor pipe for msm8x76 (git-fixes).\n- drm/msm: Properly handle msm_ioremap() without name (git-fixes).\n- drm/nouveau/svm: drain fault handler before freeing svmm (git-fixes).\n- drm/nouveau: cancel the DP IRQ work before freeing the connector (git-fixes).\n- drm/nouveau: disable the fence uevent work instead of just cancelling it (git-fixes).\n- drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq (git-fixes).\n- drm/nouveau: reject zero-size notifier object allocation (git-fixes).\n- drm/omap: dsi: avoid sending bta sync all the time in writes (git-fixes).\n- drm/panel: ebbg-ft8719: Set prepare_prev_first (git-fixes).\n- drm/panfrost: Explicitly enable MMU interrupts at device init (git-fixes).\n- drm/panfrost: Prevent division by 0 (git-fixes).\n- drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase (git-fixes).\n- drm/panthor: Take reqs_lock in soft_reset for clearing pending_reqs (git-fixes).\n- drm/tegra: Don't pass an ERR_PTR to drm_syncobj_replace_fence() (git-fixes).\n- drm/tegra: Drop reference on postfence (git-fixes).\n- drm/tegra: Fix syncobj_in wait return value check (git-fixes).\n- drm/ttm: return an error when kmapping a BO without pages (git-fixes).\n- drm/vc4: Fix firmware reference leak in vc4_drm_bind() (git-fixes).\n- drm/vc4: Use video aperture helpers (stable-fixes).\n- drm/virtio: Add a helper to map and note the dma addrs and lengths (stable-fixes).\n- drm/virtio: Use drm_gem_plane_helper_prepare_fb() (stable-fixes).\n- drm/vmwgfx: Stop using dev_private to store driver data (stable-fixes).\n- drm: of: Fix drm_of_get_data_lanes_count_ep() return value documentation (git-fixes).\n- fbdev: atmel_lcdfb: Prevent FIFO work after removal (git-fixes).\n- fbdev: gxt4500: Release WC setup on probe failure (git-fixes).\n- fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: smscufx: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: ssd1307fb: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: udlfb: check for fb_deferred_io_init() error (git-fixes).\n- fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use (git-fixes).\n- fbdev: xen-fbfront: check for fb_deferred_io_init() error (git-fixes).\n- firewire: cdev: Fix FW_CDEV_IOC_CREATE_ISO_CONTEXT references in kernel-doc (git-fixes).\n- firmware: cs_dsp: clear dsp-\u003erunning on the cs_dsp_run() error path (git-fixes).\n- firmware: imx: dsp: fix mailbox channel leak on kasprintf failure (git-fixes).\n- fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs (git-fixes).\n- gpio: crystalcove: add missing MODULE_ALIAS() (git-fixes).\n- gpio: davinci: Clear interrupt status in every bank on suspend (git-fixes).\n- gpio: pca953x: Preserve wakeup accounting on parent IRQ failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Remove unsupported motion-state field from accelerometer report (git-fixes).\n- HID: amd_sfh: Use report type from request node (git-fixes).\n- HID: core: Add reserved item tag for main items (stable-fixes).\n- HID: core: Fix out-of-bounds left shift by 32 in s32ton() (git-fixes).\n- HID: cougar: reject short special-key reports (git-fixes).\n- HID: cp2112: validate response report lengths (git-fixes).\n- HID: elo: reject short touchscreen reports (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hid-steam: Make client_opened a counter (stable-fixes).\n- HID: logitech-dj: validate unnumbered keyboard reports (git-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: validate response report length (git-fixes).\n- HID: picoLCD: check for fb_deferred_io_init() error (git-fixes).\n- HID: pxrc: reject short input reports (git-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: roccat: isku: reject short button reports (git-fixes).\n- HID: roccat: koneplus: reject short button reports (git-fixes).\n- HID: roccat: konepure: reject short button reports (git-fixes).\n- HID: roccat: kovaplus: reject short button reports (git-fixes).\n- HID: roccat: pyra: reject short button reports (git-fixes).\n- HID: roccat: ryos: reject short special reports (git-fixes).\n- HID: roccat: savu: reject short special reports (git-fixes).\n- HID: wacom: fix wacom_intuos_irq NULL pen_input deref (git-fixes).\n- HID: zydacron: validate key report length (git-fixes).\n- hostfs: fix dev_t handling (git-fixes).\n- hwmon: (coretemp) Refresh the temperature on the first read (git-fixes).\n- hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe (git-fixes).\n- hwmon: (lm70) Fix rounding of negative temperatures (git-fixes).\n- hwmon: (lm95245) Fix negative temperature conversion (git-fixes).\n- hwmon: (sht3x) Return the consumed count for heater writes (git-fixes).\n- hwrng: amd - report partial reads in non-blocking mode (git-fixes).\n- hwrng: ba431 - fix reported byte count (git-fixes).\n- hwrng: cctrng - Fix runtime PM usage counter leak (git-fixes).\n- hwrng: core - reject unknown RNG names (git-fixes).\n- hwrng: intel - return -ENOMEM when ioremap() fails (git-fixes).\n- hwrng: intel - return -ENOMEM when kmalloc_obj() fails (git-fixes).\n- hwrng: starfive - propagate clock and reset errors (git-fixes).\n- i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode() (git-fixes).\n- i2c: at91: release DMA channels when probe defers (git-fixes).\n- i2c: designware: queue only one read command for block reads (git-fixes).\n- i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len (git-fixes).\n- i2c: xiic: don't clobber msg-\u003elen to signal block-read completion (git-fixes).\n- i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode (stable-fixes).\n- iio: accel: adis16201: fix channel order for buffer mode (git-fixes).\n- iio: accel: kionix-kx022a: Fix IPOL macro name (git-fixes).\n- iio: accel: kxcjk-1013: Disable autosuspend on remove (git-fixes).\n- iio: accel: mma9551: disable autosuspend on remove (git-fixes).\n- iio: accel: mma9553: disable autosuspend on remove (git-fixes).\n- iio: adc: aspeed: propagate reset deassert errors (git-fixes).\n- iio: adc: aspeed: Simplify with dev_err_probe (stable-fixes).\n- iio: adc: at91-sama5d2: disable autosuspend on remove (git-fixes).\n- iio: adc: stm32: fix minimum sampling time values (git-fixes).\n- iio: adc: ti-adc128s052: validate SPI match data (git-fixes).\n- iio: core: add accessors 'masklength' (stable-fixes).\n- iio: dac: ad5758: Fix alignment for DMA safety (git-fixes).\n- iio: dac: ad5758: Fix the offset calculation (git-fixes).\n- iio: dac: ad5758: Reject out-of-range raw values (git-fixes).\n- iio: humidity: hts221: report available values via read_avail() (git-fixes).\n- iio: imu: adis16400: Check return value of spi_setup() (git-fixes).\n- iio: light: ltrf216a: Return floating point values (stable-fixes).\n- iio: pressure: dps310: fix CFG_REG bit definitions (git-fixes).\n- iio: temperature: tmp117: fix calibbias cache update on I2C write failure (git-fixes).\n- Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 (stable-fixes).\n- Input: da7280 - fix input device parent assignment (git-fixes).\n- Input: drv2665 - fix input device parent assignment (git-fixes).\n- Input: drv2667 - fix input device parent assignment (git-fixes).\n- Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 (stable-fixes).\n- Input: lkkbd - disable pending work before freeing device (stable-fixes).\n- Input: maple_keyb - fix key press detection (git-fixes).\n- Input: maplecontrol - emit EV_SYN report after reporting events (git-fixes).\n- Input: matrix-keymap - reject keycodes above KEY_MAX (git-fixes).\n- Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 (stable-fixes).\n- Input: tps6507x-ts - fix input device parent assignment (git-fixes).\n- Input: xpad - add support for Corsair Novablade Pro (stable-fixes).\n- kobject: fix out-of-bounds access in kobject_action_type() (git-fixes).\n- kobject: Fix the kobj_set_name reference in kset_register() kernel-doc (git-fixes).\n- KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state (git-fixes).\n- landlock: Always allow signals between threads of the same process (git-fixes).\n- landlock: Fix cosmetic change (git-fixes).\n- landlock: Fix non-TCP sockets restriction (git-fixes).\n- landlock: Fix TCP handling of short AF_UNSPEC addresses (git-fixes).\n- landlock: Fix unmarked concurrent access to socket family (git-fixes).\n- leds: flash: Prevent using uninitialized variable in flash_fault_show() (git-fixes).\n- leds: lm3692x: Fix regulator/gpio leak and wrong enabled state on last write failure (git-fixes).\n- leds: lp8860: Fix device_node leak in lp8860_probe() (git-fixes).\n- leds: pca9532: Check i2c_smbus_read_byte_data() return value (git-fixes).\n- mac80211: tx: Use info-\u003eflags in ieee80211_tx_h_select_key() (git-fixes).\n- media: adv748x: Fix endpoint reference leaks on probe failure (git-fixes).\n- media: adv7180: Initialize mutex before ancillary clients (git-fixes).\n- media: adv7604: avoid negative array index in log_status when cp_read fails (git-fixes).\n- media: amphion: fix runtime PM imbalance on probe failure (git-fixes).\n- media: amphion: prevent unbind while video instances are open (git-fixes).\n- media: atmel-isi: release unregistered video device on remove (git-fixes).\n- media: au0828: Fix media device leak in au0828_usb_probe() (git-fixes).\n- media: au0828: fix use-after-free in bulk_timeout timer on disconnect (git-fixes).\n- media: au0828: Free URBs when starting DVB streaming fails (git-fixes).\n- media: cx18: Disable PCI device on probe failure (git-fixes).\n- media: cx88: Disable PCI device on MPEG initialization failure (git-fixes).\n- media: cx231xx-audio: drain wq_trigger before audio fini (git-fixes).\n- media: cx231xx: Fix cleanup path on failure (git-fixes).\n- media: cx23885: Fix use-after-free in cx23885_finidev due to race condition (git-fixes).\n- media: cx23885: unregister DVB bus when SP2 CI setup fails (git-fixes).\n- media: em28xx: fix double free in em28xx_alloc_urbs (git-fixes).\n- media: em28xx: reject audio endpoint with zero packet size (git-fixes).\n- media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler (git-fixes).\n- media: go7007: bound EZ-USB I2C transfers to the usb_buf size (git-fixes).\n- media: go7007: unregister the I2C adapter on USB probe failure (git-fixes).\n- media: gspca: use vb2_video_unregister_device() on disconnect (git-fixes).\n- media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path (git-fixes).\n- media: hantro: Disable multicore support (stable-fixes).\n- media: hantro: disable runtime PM before hardware teardown (git-fixes).\n- media: hantro: Harden MPEG-2 control access against NULL (git-fixes).\n- media: i2c: ar0521: remove duplicate media entity cleanup (git-fixes).\n- media: i2c: ov5648: Fix a data race on state-\u003estreaming (git-fixes).\n- media: i2c: ov8856: fix debug message to report actual CSI-2 lane count (git-fixes).\n- media: i2c: tc358743: add missing color-space strings (git-fixes).\n- media: imon: fix use-after-free in display_close via dev_dbg (git-fixes).\n- media: imx-jpeg: cancel timeout worker when streaming stops (git-fixes).\n- media: imx-jpeg: finish the job on device_run() error paths (git-fixes).\n- media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled (git-fixes).\n- media: ir_toy: Validate the maximum tx carrier (git-fixes).\n- media: m2m-deinterlace: fix default capture field (git-fixes).\n- media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA (git-fixes).\n- media: marvell: manage the MMP camera clock provider (git-fixes).\n- media: mediatek: jpeg: Avoid context access after job finish (git-fixes).\n- media: mediatek: jpeg: retry HW selection after successful wait (git-fixes).\n- media: mediatek: vpu: free IRQ before destroying watchdog workqueue (git-fixes).\n- media: mediatek: vpu: release reserved memory on remove (git-fixes).\n- media: meson-ir-tx: Ensure clock is disabled on unbind (git-fixes).\n- media: meson-ir-tx: Ensure probe error is propagated (git-fixes).\n- media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() (git-fixes).\n- media: meson: vdec: size capture planes from the aligned canvas (git-fixes).\n- media: microchip-csi2dc: fix async notifier leak on probe error path (git-fixes).\n- media: microchip-isc: disable histogram and flush AWB work on teardown (git-fixes).\n- media: microchip-isc: do not touch WB registers when not streaming (git-fixes).\n- media: microchip-isc: fix PM runtime leak in AWB work handler (git-fixes).\n- media: microchip-isc: synchronize the IRQ before disabling clocks on stop (git-fixes).\n- media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() (git-fixes).\n- media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() (git-fixes).\n- media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() (git-fixes).\n- media: pvrusb2: Fix USB parent device leak in class_dev_create() (git-fixes).\n- media: rc: fintek-cir: process a full RX buffer instead of overflowing it (git-fixes).\n- media: rc: mce_kbd: Fix inconsistent locking of keylock (git-fixes).\n- media: redrat3: Ensure all urbs are suspended (git-fixes).\n- media: redrat3: Ensure we don't read beyond the end of the packet (git-fixes).\n- media: redrat3: fix UAF in probe error path leaving rc device registered (git-fixes).\n- media: require two-byte Cypress type 04 records (git-fixes).\n- media: rtl28xxu: fix SDR platform device leak (git-fixes).\n- media: saa7146: Initialize interrupt lock before requesting IRQ (git-fixes).\n- media: streamzap: Add missing rc_unregister_device() (git-fixes).\n- media: stv090x: bound DiSEqC reply length to msg size (git-fixes).\n- media: stv0900: bound DiSEqC reply length to msg size (git-fixes).\n- media: tw68: balance PCI enable on cleanup (git-fixes).\n- media: tw686x: fix V4L2 device lifetime on probe failure (git-fixes).\n- media: uvcvideo: Fix NULL deref on events for uninitialized controls (git-fixes).\n- media: v4l2-common: Fix P010 format info (git-fixes).\n- media: v4l2-ctrls: do nothing if controls == NULL in cluster functions (git-fixes).\n- media: venus: Drop session events without an instance (git-fixes).\n- media: verisilicon: rockchip: Fix leaks in init (git-fixes).\n- media: vicodec: fix NULL deref on oversized frame (git-fixes).\n- media: vicodec: fix out-of-bounds write on under-rounded coded dimensions (git-fixes).\n- media: vicodec: make encoder CAPTURE dimensions read-only (git-fixes).\n- media: vicodec: zero-initialize stateful decoder heap buffers (git-fixes).\n- media: vidtv: fix frontend reference leak on unbind (git-fixes).\n- media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail (git-fixes).\n- media: vim2m: keep transaction buffer count stable while streaming (git-fixes).\n- media: vivid: round the height down to the vertical subsampling factor (git-fixes).\n- media: vpif_display: Fix i2c adapter reference leak in vpif_probe() (git-fixes).\n- mei: vsc-tp: initialize IRQ state before requesting interrupt (git-fixes).\n- mei: vsc: Fix packet CRC computed over pointer size (git-fixes).\n- mfd: ab8500: Fix child device leaks on probe failure (git-fixes).\n- mfd: da9150: Balance IRQ wake on teardown (git-fixes).\n- mfd: intel_quark_i2c_gpio: Manage the fixed-rate clock (git-fixes).\n- mfd: tps65217: Check return value when masking interrupt sources (git-fixes).\n- mfd: tps65217: Fix NULL pointer dereference on IRQ init failure (git-fixes).\n- mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral (git-fixes).\n- mfd: wcd934x: set DMA mask on parent to silence 'DMA mask not set' (git-fixes).\n- misc: enclosure: fix UAF on device_register() failure (git-fixes).\n- mm, vmscan: flush tlb before large folio is freed (bsc#1250656).\n- mm: introduce num_pages_contiguous() (bsc#1284243).\n- mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() (git-fixes).\n- mtd: block: prevent reclaim I/O during request processing (git-fixes).\n- mtd: Call get_wunit() on the master partition (git-fixes).\n- mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device (git-fixes).\n- mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() (git-fixes).\n- mtd: maps: l440gx: Fix double put of the PM device in init_l440gx() (git-fixes).\n- mtd: maps: pci: balance PCI enable on cleanup (git-fixes).\n- mtd: parsers: qcom: fix offset/size overflow on large partitions (git-fixes).\n- mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() (git-fixes).\n- mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface() (git-fixes).\n- mtd: rawnand: sunxi: reject ECC maximization on small pages (git-fixes).\n- mtd: spi-nor: sfdp: check the length of the SCCR map (git-fixes).\n- mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table (git-fixes).\n- mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption (git-fixes).\n- mtd: spinand: Fix spinand_manufacturer_ops kernel-doc (git-fixes).\n- net: usb: lan78xx: reject invalid EEPROM write requests (git-fixes).\n- net: usb: r8153_ecm: reject short register reads (git-fixes).\n- net: usb: sierra_net: reject short firmware attribute reads (git-fixes).\n- net: wwan: iosm: validate msg_head before indexing msg_ring (git-fixes).\n- PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow (git-fixes).\n- PCI/AER: Fix struct pci_dev reference leak in aer_process_err_devices() (git-fixes).\n- PCI/P2PDMA: Gate the host bridge whitelist warning on verbose (git-fixes).\n- PCI/P2PDMA: Safely terminate ACS redirect lists (git-fixes).\n- PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible() (git-fixes).\n- PCI/sysfs: Pass the device name length in UTF-16 code units (git-fixes).\n- PCI/sysfs: Stop reporting _DSM failures as -EPERM (git-fixes).\n- PCI: aardvark: Disable PHY on probe failures (git-fixes).\n- PCI: cadence: Preserve all error codes in cdns_plat_pcie_probe() (git-fixes).\n- PCI: Disable MSI for ULi M1575 EHCI controller (git-fixes).\n- PCI: dra7xx: Fix clock enable leak on probe failure (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Pass PF/VF number when BAR programming (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Serialize virtual PCI bus scan (git-fixes).\n- PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr() (git-fixes).\n- PCI: qcom: Honor IOMMU provider's #iommu-cells in qcom_pcie_config_sid_1_9_0() (git-fixes).\n- PCI: rockchip-host: Do not attempt 5.0 GT/s retraining (git-fixes).\n- PCI: xgene: Use managed clock for PCIe controller (git-fixes).\n- peci: aspeed: Initialize state before requesting IRQ (git-fixes).\n- phy: core: Fix race-condition between _of_phy_get() and try_module_get() (git-fixes).\n- pinctrl: mediatek: mt7629: fix the 2.4 GHz Wi-Fi pin mode array (git-fixes).\n- pinctrl: sprd: free maps on DT map failure (git-fixes).\n- pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() (git-fixes).\n- platform/chrome: cros_ec_proto: Fix deferred response (git-fixes).\n- power: supply: charger-manager: Convert to platform remove callback returning void (stable-fixes).\n- power: supply: lp8788-charger: Convert to platform remove callback returning void (stable-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: lp8788: Use devm_power_supply_register() helper (stable-fixes).\n- pwm: mtk-disp: Fix period readback (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- regulator: ab8500: Fix AB8505 VANA voltage selectors (git-fixes).\n- regulator: ab8500: Handle AB8505 VINTCORE selector 7 (git-fixes).\n- regulator: ab8500: Propagate mode enable read errors (git-fixes).\n- regulator: ab8500: Test dedicated enable bits only (git-fixes).\n- regulator: ab8500: Treat cut 1.0 VAUX3 as fixed (git-fixes).\n- regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() (git-fixes).\n- regulator: core: Fix coupled regulators reference leak on removal (git-fixes).\n- regulator: core: Fix rdev reference leak in regulator_resolve_supply() (git-fixes).\n- regulator: mp886x: check get_voltage_sel() return value (git-fixes).\n- regulator: mp886x: fix pontential division by zero (git-fixes).\n- regulator: mp886x: fix vsel_mask (git-fixes).\n- regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() (git-fixes).\n- Reinstate 'resource: avoid unnecessary lookups in find_next_iomem_res()' (bsc#1284243).\n- Revert 'wifi: mac80211: do not use old MBSSID elements' (git-fixes).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests/alsa: Do not take another control's event as our own (git-fixes).\n- selftests/landlock: Add a new test for setuid() (git-fixes).\n- selftests/landlock: Fix build with non-default pthread linking (git-fixes).\n- selftests/landlock: Fix screwed up pointers in the scoped_signal_test (git-fixes).\n- selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available (git-fixes).\n- selftests/landlock: Split signal_scoping_threads tests (git-fixes).\n- serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() (git-fixes).\n- serial: core: shut down initialized port on removal (git-fixes).\n- serial: max310x: don't clobber the TX break bit in set_termios (git-fixes).\n- serial: pmac_zilog: push received data to the port that received it (git-fixes).\n- serial: pmac_zilog: report received breaks (git-fixes).\n- slimbus: messaging: fix leaked PM vote on tid allocation failure (git-fixes).\n- soc/tegra: flowctrl: Release OF node reference on error (git-fixes).\n- soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() (git-fixes).\n- soc: fsl: dpio: Fix cleanup on IRQ registration failure (git-fixes).\n- soc: fsl: dpio: Free the IRQ before releasing the I/O object (git-fixes).\n- soc: qcom: apr: clean up failed service registrations (git-fixes).\n- soc: ti: k3-ringacc: Correct ring API kernel-doc (git-fixes).\n- soc: ti: k3-ringacc: Fix DMA ring initialization kernel-doc (git-fixes).\n- spi: amd: fix len==0 underflow and FIFO overflow (git-fixes).\n- spi: bcm63xx-hsspi: Disable runtime PM on remove (git-fixes).\n- spi: Fix the return value in spi_new_ancillary_device() kernel-doc (git-fixes).\n- spi: jcore: fix divide-by-zero when speed_hz is zero (git-fixes).\n- spi: mtk-nor: fix runtime PM usage count leak in probe error path (git-fixes).\n- spi: mxic: fix ps_clk leak in runtime resume (git-fixes).\n- spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer (git-fixes).\n- spi: omap2-mcspi: Remove unbalanced pm_runtime_put_sync() calls (git-fixes).\n- spi: spi-sun4i: sun4i_spi_fill_fifo(): always apply A10 FIFO fill level workaround (git-fixes).\n- spi: spi-sun4i: sun4i_spi_transfer_one(): fix transfers for SUN4I_FIFO_DEPTH (git-fixes).\n- staging: iio: adc: ad7816: Fix DMA safety issues in SPI transfers (git-fixes).\n- staging: media: av7110: fix corrupted BER reporting in sp8870 (git-fixes).\n- staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error (git-fixes).\n- staging: rtl8723bs: clean up redundant \u0026 parentheses (stable-fixes).\n- Staging: rtl8723bs: Delete dead code from update_current_network() (stable-fixes).\n- staging: rtl8723bs: fix buffer over-read in rtw_update_protection (git-fixes).\n- staging: rtl8723bs: fix RX buffer OOB write from device-reported length (git-fixes).\n- Staging: rtl8723bs: Remove dead code from _rtw_free_network() (stable-fixes).\n- staging: sm750fb: free cmap on framebuffer release (git-fixes).\n- thermal/drivers/sprd: validate the sensor id from the device tree (git-fixes).\n- thermal: intel: int340x: Fix temperature selection around 0 C (git-fixes).\n- thermal: intel: powerclamp: Reject invalid window_size values (git-fixes).\n- thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc (git-fixes).\n- thunderbolt: Disable CL states for the Anker Prime TB5 dock (stable-fixes).\n- thunderbolt: Do not RPM complete unrelated subtrees on unplug (git-fixes).\n- tools/thermal/tmon: Fix string truncation warning in optarg copy (git-fixes).\n- tpm: fix zero-length read discarding the pending response (git-fixes).\n- tpm: tpm_nsc: fix NULL pointer dereference on init failure (git-fixes).\n- tpm: tpm_nsc: stop using the cleanup callback as dev.release (git-fixes).\n- tty: add break_wait kernel-doc (git-fixes).\n- tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup (stable-fixes).\n- tty: vcc: zero-initialize control packet in vcc_send_ctl() (stable-fixes).\n- um: hostfs: avoid issues on inode number reuse by host (git-fixes).\n- usb-storage: alauda: check the return value of alauda_read_map() (git-fixes).\n- usb-storage: alauda: do not do DMA from the stack (git-fixes).\n- usb-storage: alauda: fix out-of-bounds zone index (git-fixes).\n- USB: cdc-acm: fix urb leak on disconnect (git-fixes).\n- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (stable-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior (stable-fixes).\n- usb: fotg210: validate endpoint index in ep0 handlers (git-fixes).\n- usb: gadget: composite: avoid warning on aborted delayed status (git-fixes).\n- usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket (git-fixes).\n- usb: gadget: dummy_hcd: prevent unbind via sysfs (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_mass_storage: ignore class requests while inactive (git-fixes).\n- usb: gadget: f_midi: Annotate struct f_midi with __counted_by (stable-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- usb: gadget: functionfs: Factorize wait-for-endpoint code (stable-fixes).\n- usb: image: microtek: stop SG processing after transfer errors (git-fixes).\n- usb: musb: da8xx: depopulate OF children on probe failure (git-fixes).\n- usb: musb: da8xx: depopulate OF children on remove (git-fixes).\n- usb: ohci-spear: disable controller wakeup on removal (git-fixes).\n- usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() (stable-fixes).\n- USB: pci-quirks: Release EHCI device reference (git-fixes).\n- USB: serial: cp210x: add Corsair AX1500i Power Supply (stable-fixes).\n- USB: serial: option: add Compal EXC-T1 support (stable-fixes).\n- USB: serial: option: add Compal EXM-G1x support (stable-fixes).\n- USB: serial: option: add Quectel EG060W (stable-fixes).\n- USB: serial: option: add Quectel RG660QB (stable-fixes).\n- USB: serial: option: add support for SIMCom SIM8260C (stable-fixes).\n- USB: serial: sierra: fix urb leak on write completion (git-fixes).\n- USB: serial: usb_wwan: fix urb leak on disconnect (git-fixes).\n- usb: typec: ucsi_ccg: Add retry mechanism in ccg_read (git-fixes).\n- USB: usbmon: fix null-ptr-deref in mon_bus_remove() when mon_bus_init() fails (git-fixes).\n- usbnet: fix smp_processor_id() use in preemptible context (git-fixes).\n- vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() (bsc#1284243).\n- vfio/type1: conditional rescheduling while pinning (bsc#1284243).\n- vfio/type1: introduce a new member has_rsvd for struct vfio_dma (bsc#1284243).\n- vfio/type1: optimize vfio_pin_pages_remote() (bsc#1284243).\n- vfio/type1: optimize vfio_unpin_pages_remote() (bsc#1284243).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: mediatek: Apply the driver's mode to a watchdog left running (git-fixes).\n- wifi: ath6kl: don't take RTNL in del_virtual_intf (git-fixes).\n- wifi: ath9k: delete channel-context timers on deinit (git-fixes).\n- wifi: ath10k: avoid IDR mutation during TX cleanup (git-fixes).\n- wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup (git-fixes).\n- wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).\n- wifi: ath11k: disable interrupts during firmware crash recovery (git-fixes).\n- wifi: ath11k: fix locking problem in ath11k_dp_rx_tid_del_func() (git-fixes).\n- wifi: ath11k: fix NULL dereference in ahb remove when QMI init incomplete (git-fixes).\n- wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() (git-fixes).\n- wifi: ath11k: fix sporadic WLAN initialization failures (git-fixes).\n- wifi: ath11k: fix unbalanced IRQ enable/disable during suspend/resume (git-fixes).\n- wifi: ath11k: modify null check logic in ath11k_ce_rx_post_pipe() (git-fixes).\n- wifi: ath11k: reset ar-\u003enum_stations on hardware start (git-fixes).\n- wifi: ath11k: unregister PM notifier on QMI init failure path (git-fixes).\n- wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).\n- wifi: ath12k: fix incorrect TID updation in DP monitor status path (stable-fixes).\n- wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info (stable-fixes).\n- wifi: ath12k: fix the fetching of combined rssi (git-fixes).\n- wifi: ath12k: Free allocated CE IRQs on request_irq() failure (git-fixes).\n- wifi: ath12k: Reserve space for a string terminator (git-fixes).\n- wifi: b43: don't pass unterminated string to sscanf() (git-fixes).\n- wifi: b43: fix use-after-free in b43_bcma_remove() (git-fixes).\n- wifi: b43legacy: debugfs: NUL terminate string in debugfs (git-fixes).\n- wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz (git-fixes).\n- wifi: carl9170: NUL terminate string in debugfs (git-fixes).\n- wifi: cfg80211: allow zero HE OBSS PD offsets (git-fixes).\n- wifi: cfg80211: preserve hidden-group beacon IE ownership (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: track SSID regardless of country data (git-fixes).\n- wifi: cw1200: fix TX padding OOB read leaking heap data to device (git-fixes).\n- wifi: iwlegacy: 3945: free EEPROM data on remove (git-fixes).\n- wifi: iwlwifi: dvm: pair transport op-mode enter/leave (stable-fixes).\n- wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp* (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: iwlwifi: simplify nested if checks (stable-fixes).\n- wifi: mac80211: account proxy paths against the mesh path limit (git-fixes).\n- wifi: mac80211: Add 802.3 multicast encapsulation offload support (stable-fixes).\n- wifi: mac80211: Add multicast to unicast support for 802.3 path (stable-fixes).\n- wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() (stable-fixes).\n- wifi: mac80211: clear fragment cache entry 'is_protected' (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't reset the TXQ scheduling round number (git-fixes).\n- wifi: mac80211: don't send encap offload frames unencrypted (git-fixes).\n- wifi: mac80211: drain PS delivery work during station teardown (git-fixes).\n- wifi: mac80211: drop encap offload frames with a tainted key (git-fixes).\n- wifi: mac80211: Fix a race when expiring a mesh path (git-fixes).\n- wifi: mac80211: fix encryption tailroom (git-fixes).\n- wifi: mac80211: fix key selection for encap offload frames (git-fixes).\n- wifi: mac80211: fix mesh fast xmit path deletion UAF (git-fixes).\n- wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (stable-fixes).\n- wifi: mac80211: fix swapped fq_overlimit/fq_overmemory in aqm debugfs (git-fixes).\n- wifi: mac80211: Fix the return value in mesh_path_add() kernel-doc (git-fixes).\n- wifi: mac80211: fix typo in HE MCS check (stable-fixes).\n- wifi: mac80211: fix unauthorised port check for encap offload (git-fixes).\n- wifi: mac80211: handle empty FILS association request payload (git-fixes).\n- wifi: mac80211: init radiotap iter after length checks (git-fixes).\n- wifi: mac80211: kill wake_txqs_tasklet on unregistration (git-fixes).\n- wifi: mac80211: limit injected HT/VHT MCSes (git-fixes).\n- wifi: mac80211: log link information in ieee80211_determine_chan_mode (stable-fixes).\n- wifi: mac80211: mesh: use hlist_add_head_rcu() (git-fixes).\n- wifi: mac80211: minstrel_ht: validate fixed rate index (git-fixes).\n- wifi: mac80211: prevent AP VLAN tx from other interfaces (git-fixes).\n- wifi: mac80211: refactor populating mesh related fields in sinfo (stable-fixes).\n- wifi: mac80211: release mesh path quota on failed additions (git-fixes).\n- wifi: mac80211: reserve MME tailroom for protected beacons (git-fixes).\n- wifi: mac80211: set info-\u003eband for 802.3 encap offload frames (git-fixes).\n- wifi: mac80211: use link address as TA for non-MLO 4-addr station on MLD AP (git-fixes).\n- wifi: mt76: feed the station RSSI average from the chain signals (git-fixes).\n- wifi: mt76: fix memory leak in USB TX path (git-fixes).\n- wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() (git-fixes).\n- wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add() (git-fixes).\n- wifi: mt76: fix wcid-\u003epktid corruption in mt76_wcid_cleanup() (git-fixes).\n- wifi: mt76: mt76x02: validate RX padding before use (git-fixes).\n- wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff (git-fixes).\n- wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory (git-fixes).\n- wifi: mt76: mt7603: don't drop short frames looped back on PS entry (git-fixes).\n- wifi: mt76: mt7615: cancel reset work during unregister (git-fixes).\n- wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs (git-fixes).\n- wifi: mt76: mt7615: read MT7663 temperature from the correct offset (git-fixes).\n- wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy (git-fixes).\n- wifi: mt76: mt7615: validate MCU response lengths (git-fixes).\n- wifi: mt76: mt7915: allocate vif wcid in the same range as stations (stable-fixes).\n- wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (git-fixes).\n- wifi: mt76: mt7915: check default EEPROM firmware size before copying (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() (git-fixes).\n- wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump (git-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure (git-fixes).\n- wifi: mt76: mt7921: check drv_pmctrl return in the PCIe reset path (git-fixes).\n- wifi: mt76: mt7921: fix lock inversion between dev-\u003emutex and iflist_mtx (git-fixes).\n- wifi: mt76: mt7921: fix the lock inversion in suspend and resume (git-fixes).\n- wifi: mt76: mt7925: check drv_pmctrl return in the PCIe reset path (git-fixes).\n- wifi: mt76: mt7925: fix lock inversion between dev-\u003emutex and iflist_mtx (git-fixes).\n- wifi: mt76: mt7925: fix the lock inversion in suspend and resume (git-fixes).\n- wifi: mt76: mt7925: honour mac80211's FIF_FCSFAIL instead of hardcoding drop_err (git-fixes).\n- wifi: mt76: mt7925: restore the reset state when fw_pmctrl fails (git-fixes).\n- wifi: mt76: mt7996: fix PLE free page and AC queue register offsets (git-fixes).\n- wifi: mt76: mt7996: validate firmware event lengths before parsing (git-fixes).\n- wifi: mt76: usb: fix source overread in mt76u_copy (git-fixes).\n- wifi: mwifiex: append hotfix number to firmware version string (git-fixes).\n- wifi: rtw88: debugfs: don't vzalloc(0) when rsvd_page is read unconfigured (git-fixes).\n- wifi: rtw88: debugfs: support multiple adapters debugging (stable-fixes).\n- wifi: rtw88: fix out-of-bounds CAM write when key table is full (git-fixes).\n- wifi: rtw88: sdio: zero the padding added to a TX transfer (git-fixes).\n- wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields (git-fixes).\n- wifi: rtw89: cap firmware section_num before parsing (git-fixes).\n- wifi: wfx: fix possible device hang during init (git-fixes).\n- wifi: wfx: fix use-after-free of the cooling work on device removal (git-fixes).\n- wifi: wfx: validate MIB read length before copying to caller (git-fixes).\n- wwan: wwan_hwsim: Pin module for debugfs file operations (git-fixes).\n- x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() (git-fixes).\n- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (git-fixes).\n- xhci: dbc: lock the minor IDR on registration failure (git-fixes).\n","status":"published","published":"2026-11-03T16:27:43Z","modified":"2026-11-04T14:15:08.544785478Z","updated_at":"2026-11-04T14:31:33.296313Z"}]}}