{"id":"CVE-2024-53201","aliases":["AZL-55294","BELL-CVE-2024-53201","DEBIAN-CVE-2024-53201","EUVD-2024-51873","GHSA-9pwp-p2rw-34f5","OESA-2025-1093","OESA-2025-1095","OESA-2025-1096","OESA-2025-1097","SUSE-SU-2025:0117-1","SUSE-SU-2025:0153-1","SUSE-SU-2025:0154-1","SUSE-SU-2025:0289-1","SUSE-SU-2025:20165-1","SUSE-SU-2025:20166-1","SUSE-SU-2025:20248-1","SUSE-SU-2025:20249-1","UBUNTU-CVE-2024-53201","USN-7310-1","USN-7449-1","USN-7449-2","USN-7450-1","USN-7451-1","USN-7452-1","USN-7453-1"],"status":"published","title":"drm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00262,"percentile":0.18085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-12-27T13:49:42Z","modified":"2026-11-05T14:17:08Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.6.160","6.11.11","6.12.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.12.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1027.32~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1028.30~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-58.60~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1024.24~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-58.60.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1026.29~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1024.25~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-58.60.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1020.21~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-58.60"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1027.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1027.32"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1028.30"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1023.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1010.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1024.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-58.60.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1026.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1026.29.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","fixed_in":["6.11.0-1015.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","fixed_in":["6.8.0-1026.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1024.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","fixed_in":["6.8.0-58.60.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1020.21"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.161.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.89-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.11.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.3-1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-76.0.0.80.oe2403sp1"}]}],"bundled":53},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-248.0.0.150.oe2203sp3"}]}],"bundled":40},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-248.0.0.147.oe2203sp4"}]}],"bundled":40},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-76.0.0.69.oe2403"}]}],"bundled":143},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.23.1"}]}],"bundled":116},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.23.1"}]}],"bundled":116},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.23.1"}]}],"bundled":116},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.23.1"}]}],"bundled":116},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.23.1"}]}],"bundled":116},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.23.1"}]}],"bundled":116},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6-RT_Update_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.1.3.1"}]}],"bundled":114},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.23.1"}]}],"bundled":114},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1.150600.12.14.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1.150600.12.14.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.33.1"}]}],"bundled":117},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6","package":"kernel-coco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-15061.12.coco15sp6.1"}]}],"bundled":343},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6","package":"kernel-coco_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-15061.12.coco15sp6.1"}]}],"bundled":343},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6","package":"kernel-source-coco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-15061.12.coco15sp6.1"}]}],"bundled":343},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6","package":"kernel-syms-coco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-15061.12.coco15sp6.1"}]}],"bundled":343},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-24.1.21.4"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-livepatch-MICRO-6-0_Update_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.2"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-livepatch-MICRO-6-0-RT_Update_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.1"}]}],"bundled":610},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":610},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":610},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-24.1.21.4"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-livepatch-MICRO-6-0_Update_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.2"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":357},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-livepatch-MICRO-6-0-RT_Update_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.1"}]}],"bundled":610},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":610},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-25.1"}]}],"bundled":610},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.32~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.30~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.24~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.29~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.25~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1020.21~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.29"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.32"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.30"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1023.27"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1010.12"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.24"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.29"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.29.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1008.8"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1015.15"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.26"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.25"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60.1"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1020.21"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1015.15"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13"],"bundled":730},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.32~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.29~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.25~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.29"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.32"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.24"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.29"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.29.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1026.26"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1024.25"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-58.60~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1"],"bundled":461},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.30"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29"],"bundled":460},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1023.27"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26"],"bundled":460},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1010.12"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11"],"bundled":460},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1027.29~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1"],"bundled":577},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.30~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1"],"bundled":460},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1020.21"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20"],"bundled":461}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/82f7058ce05c1fad8573950c50bb5befafe7e787","tags":["web"]},{"url":"https://git.kernel.org/stable/c/0335fb698ab0415d87650bc7a0f465c563ddec7d","tags":["web"]},{"url":"https://git.kernel.org/stable/c/6b4ee2560d4d8de2688da68cd9581177035e0876","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/3609259326171cd5b98462636580fb2ae5c87d40","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53201","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9pwp-p2rw-34f5"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-53201","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53201.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53201","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26952","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53140","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56641","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56758","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21670","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52513","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26748","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36484","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56746","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52434","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38585","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39482","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44972","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49951","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49988","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53166","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56589","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214954","tags":["report"]},{"url":"https://bugzilla.suse.com/1216813","tags":["report"]},{"url":"https://bugzilla.suse.com/1220773","tags":["report"]},{"url":"https://bugzilla.suse.com/1224095","tags":["report"]},{"url":"https://bugzilla.suse.com/1224726","tags":["report"]},{"url":"https://bugzilla.suse.com/1225743","tags":["report"]},{"url":"https://bugzilla.suse.com/1225758","tags":["report"]},{"url":"https://bugzilla.suse.com/1225820","tags":["report"]},{"url":"https://bugzilla.suse.com/1227445","tags":["report"]},{"url":"https://bugzilla.suse.com/1228526","tags":["report"]},{"url":"https://bugzilla.suse.com/1229809","tags":["report"]},{"url":"https://bugzilla.suse.com/1230205","tags":["report"]},{"url":"https://bugzilla.suse.com/1230413","tags":["report"]},{"url":"https://bugzilla.suse.com/1230697","tags":["report"]},{"url":"https://bugzilla.suse.com/1231854","tags":["report"]},{"url":"https://bugzilla.suse.com/1231909","tags":["report"]},{"url":"https://bugzilla.suse.com/1231963","tags":["report"]},{"url":"https://bugzilla.suse.com/1232193","tags":["report"]},{"url":"https://bugzilla.suse.com/1232198","tags":["report"]},{"url":"https://bugzilla.suse.com/1232201","tags":["report"]},{"url":"https://bugzilla.suse.com/1232418","tags":["report"]},{"url":"https://bugzilla.suse.com/1232419","tags":["report"]},{"url":"https://bugzilla.suse.com/1232420","tags":["report"]},{"url":"https://bugzilla.suse.com/1232421","tags":["report"]},{"url":"https://bugzilla.suse.com/1232436","tags":["report"]},{"url":"https://bugzilla.suse.com/1233038","tags":["report"]},{"url":"https://bugzilla.suse.com/1233070","tags":["report"]},{"url":"https://bugzilla.suse.com/1233096","tags":["report"]},{"url":"https://bugzilla.suse.com/1233200","tags":["report"]},{"url":"https://bugzilla.suse.com/1233204","tags":["report"]},{"url":"https://bugzilla.suse.com/1233239","tags":["report"]},{"url":"https://bugzilla.suse.com/1233259","tags":["report"]},{"url":"https://bugzilla.suse.com/1233260","tags":["report"]},{"url":"https://bugzilla.suse.com/1233324","tags":["report"]},{"url":"https://bugzilla.suse.com/1233328","tags":["report"]},{"url":"https://bugzilla.suse.com/1233461","tags":["report"]},{"url":"https://bugzilla.suse.com/1233467","tags":["report"]},{"url":"https://bugzilla.suse.com/1233468","tags":["report"]},{"url":"https://bugzilla.suse.com/1233469","tags":["report"]},{"url":"https://bugzilla.suse.com/1233546","tags":["report"]},{"url":"https://bugzilla.suse.com/1233558","tags":["report"]},{"url":"https://bugzilla.suse.com/1233637","tags":["report"]},{"url":"https://bugzilla.suse.com/1233642","tags":["report"]},{"url":"https://bugzilla.suse.com/1233772","tags":["report"]},{"url":"https://bugzilla.suse.com/1233837","tags":["report"]},{"url":"https://bugzilla.suse.com/1234024","tags":["report"]},{"url":"https://bugzilla.suse.com/1234069","tags":["report"]},{"url":"https://bugzilla.suse.com/1234071","tags":["report"]},{"url":"https://bugzilla.suse.com/1234073","tags":["report"]},{"url":"https://bugzilla.suse.com/1234075","tags":["report"]},{"url":"https://bugzilla.suse.com/1234076","tags":["report"]},{"url":"https://bugzilla.suse.com/1234077","tags":["report"]},{"url":"https://bugzilla.suse.com/1234079","tags":["report"]},{"url":"https://bugzilla.suse.com/1234086","tags":["report"]},{"url":"https://bugzilla.suse.com/1234139","tags":["report"]},{"url":"https://bugzilla.suse.com/1234140","tags":["report"]},{"url":"https://bugzilla.suse.com/1234141","tags":["report"]},{"url":"https://bugzilla.suse.com/1234142","tags":["report"]},{"url":"https://bugzilla.suse.com/1234143","tags":["report"]},{"url":"https://bugzilla.suse.com/1234144","tags":["report"]},{"url":"https://bugzilla.suse.com/1234145","tags":["report"]},{"url":"https://bugzilla.suse.com/1234146","tags":["report"]},{"url":"https://bugzilla.suse.com/1234147","tags":["report"]},{"url":"https://bugzilla.suse.com/1234148","tags":["report"]},{"url":"https://bugzilla.suse.com/1234149","tags":["report"]},{"url":"https://bugzilla.suse.com/1234150","tags":["report"]},{"url":"https://bugzilla.suse.com/1234153","tags":["report"]},{"url":"https://bugzilla.suse.com/1234155","tags":["report"]},{"url":"https://bugzilla.suse.com/1234156","tags":["report"]},{"url":"https://bugzilla.suse.com/1234158","tags":["report"]},{"url":"https://bugzilla.suse.com/1234159","tags":["report"]},{"url":"https://bugzilla.suse.com/1234160","tags":["report"]},{"url":"https://bugzilla.suse.com/1234161","tags":["report"]},{"url":"https://bugzilla.suse.com/1234162","tags":["report"]},{"url":"https://bugzilla.suse.com/1234163","tags":["report"]},{"url":"https://bugzilla.suse.com/1234164","tags":["report"]},{"url":"https://bugzilla.suse.com/1234165","tags":["report"]},{"url":"https://bugzilla.suse.com/1234166","tags":["report"]},{"url":"https://bugzilla.suse.com/1234167","tags":["report"]},{"url":"https://bugzilla.suse.com/1234168","tags":["report"]},{"url":"https://bugzilla.suse.com/1234169","tags":["report"]},{"url":"https://bugzilla.suse.com/1234170","tags":["report"]},{"url":"https://bugzilla.suse.com/1234171","tags":["report"]},{"url":"https://bugzilla.suse.com/1234172","tags":["report"]},{"url":"https://bugzilla.suse.com/1234173","tags":["report"]},{"url":"https://bugzilla.suse.com/1234174","tags":["report"]},{"url":"https://bugzilla.suse.com/1234175","tags":["report"]},{"url":"https://bugzilla.suse.com/1234176","tags":["report"]},{"url":"https://bugzilla.suse.com/1234177","tags":["report"]},{"url":"https://bugzilla.suse.com/1234178","tags":["report"]},{"url":"https://bugzilla.suse.com/1234179","tags":["report"]},{"url":"https://bugzilla.suse.com/1234180","tags":["report"]},{"url":"https://bugzilla.suse.com/1234181","tags":["report"]},{"url":"https://bugzilla.suse.com/1234182","tags":["report"]},{"url":"https://bugzilla.suse.com/1234183","tags":["report"]},{"url":"https://bugzilla.suse.com/1234184","tags":["report"]},{"url":"https://bugzilla.suse.com/1234185","tags":["report"]},{"url":"https://bugzilla.suse.com/1234186","tags":["report"]},{"url":"https://bugzilla.suse.com/1234187","tags":["report"]},{"url":"https://bugzilla.suse.com/1234188","tags":["report"]},{"url":"https://bugzilla.suse.com/1234189","tags":["report"]},{"url":"https://bugzilla.suse.com/1234190","tags":["report"]},{"url":"https://bugzilla.suse.com/1234191","tags":["report"]},{"url":"https://bugzilla.suse.com/1234192","tags":["report"]},{"url":"https://bugzilla.suse.com/1234193","tags":["report"]},{"url":"https://bugzilla.suse.com/1234194","tags":["report"]},{"url":"https://bugzilla.suse.com/1234195","tags":["report"]},{"url":"https://bugzilla.suse.com/1234196","tags":["report"]},{"url":"https://bugzilla.suse.com/1234197","tags":["report"]},{"url":"https://bugzilla.suse.com/1234198","tags":["report"]},{"url":"https://bugzilla.suse.com/1234199","tags":["report"]},{"url":"https://bugzilla.suse.com/1234200","tags":["report"]},{"url":"https://bugzilla.suse.com/1234201","tags":["report"]},{"url":"https://bugzilla.suse.com/1234203","tags":["report"]},{"url":"https://bugzilla.suse.com/1234204","tags":["report"]},{"url":"https://bugzilla.suse.com/1234205","tags":["report"]},{"url":"https://bugzilla.suse.com/1234207","tags":["report"]},{"url":"https://bugzilla.suse.com/1234208","tags":["report"]},{"url":"https://bugzilla.suse.com/1234209","tags":["report"]},{"url":"https://bugzilla.suse.com/1234219","tags":["report"]},{"url":"https://bugzilla.suse.com/1234220","tags":["report"]},{"url":"https://bugzilla.suse.com/1234221","tags":["report"]},{"url":"https://bugzilla.suse.com/1234237","tags":["report"]},{"url":"https://bugzilla.suse.com/1234238","tags":["report"]},{"url":"https://bugzilla.suse.com/1234239","tags":["report"]},{"url":"https://bugzilla.suse.com/1234240","tags":["report"]},{"url":"https://bugzilla.suse.com/1234241","tags":["report"]},{"url":"https://bugzilla.suse.com/1234242","tags":["report"]},{"url":"https://bugzilla.suse.com/1234243","tags":["report"]},{"url":"https://bugzilla.suse.com/1234278","tags":["report"]},{"url":"https://bugzilla.suse.com/1234279","tags":["report"]},{"url":"https://bugzilla.suse.com/1234280","tags":["report"]},{"url":"https://bugzilla.suse.com/1234281","tags":["report"]},{"url":"https://bugzilla.suse.com/1234282","tags":["report"]},{"url":"https://bugzilla.suse.com/1234294","tags":["report"]},{"url":"https://bugzilla.suse.com/1234338","tags":["report"]},{"url":"https://bugzilla.suse.com/1234357","tags":["report"]},{"url":"https://bugzilla.suse.com/1234381","tags":["report"]},{"url":"https://bugzilla.suse.com/1234454","tags":["report"]},{"url":"https://bugzilla.suse.com/1234464","tags":["report"]},{"url":"https://bugzilla.suse.com/1234605","tags":["report"]},{"url":"https://bugzilla.suse.com/1234651","tags":["report"]},{"url":"https://bugzilla.suse.com/1234652","tags":["report"]},{"url":"https://bugzilla.suse.com/1234654","tags":["report"]},{"url":"https://bugzilla.suse.com/1234655","tags":["report"]},{"url":"https://bugzilla.suse.com/1234657","tags":["report"]},{"url":"https://bugzilla.suse.com/1234658","tags":["report"]},{"url":"https://bugzilla.suse.com/1234659","tags":["report"]},{"url":"https://bugzilla.suse.com/1234668","tags":["report"]},{"url":"https://bugzilla.suse.com/1234690","tags":["report"]},{"url":"https://bugzilla.suse.com/1234725","tags":["report"]},{"url":"https://bugzilla.suse.com/1234726","tags":["report"]},{"url":"https://bugzilla.suse.com/1234810","tags":["report"]},{"url":"https://bugzilla.suse.com/1234811","tags":["report"]},{"url":"https://bugzilla.suse.com/1234826","tags":["report"]},{"url":"https://bugzilla.suse.com/1234827","tags":["report"]},{"url":"https://bugzilla.suse.com/1234829","tags":["report"]},{"url":"https://bugzilla.suse.com/1234832","tags":["report"]},{"url":"https://bugzilla.suse.com/1234834","tags":["report"]},{"url":"https://bugzilla.suse.com/1234843","tags":["report"]},{"url":"https://bugzilla.suse.com/1234846","tags":["report"]},{"url":"https://bugzilla.suse.com/1234848","tags":["report"]},{"url":"https://bugzilla.suse.com/1234853","tags":["report"]},{"url":"https://bugzilla.suse.com/1234855","tags":["report"]},{"url":"https://bugzilla.suse.com/1234856","tags":["report"]},{"url":"https://bugzilla.suse.com/1234884","tags":["report"]},{"url":"https://bugzilla.suse.com/1234889","tags":["report"]},{"url":"https://bugzilla.suse.com/1234891","tags":["report"]},{"url":"https://bugzilla.suse.com/1234899","tags":["report"]},{"url":"https://bugzilla.suse.com/1234900","tags":["report"]},{"url":"https://bugzilla.suse.com/1234905","tags":["report"]},{"url":"https://bugzilla.suse.com/1234907","tags":["report"]},{"url":"https://bugzilla.suse.com/1234909","tags":["report"]},{"url":"https://bugzilla.suse.com/1234911","tags":["report"]},{"url":"https://bugzilla.suse.com/1234912","tags":["report"]},{"url":"https://bugzilla.suse.com/1234916","tags":["report"]},{"url":"https://bugzilla.suse.com/1234918","tags":["report"]},{"url":"https://bugzilla.suse.com/1234920","tags":["report"]},{"url":"https://bugzilla.suse.com/1234921","tags":["report"]},{"url":"https://bugzilla.suse.com/1234922","tags":["report"]},{"url":"https://bugzilla.suse.com/1234929","tags":["report"]},{"url":"https://bugzilla.suse.com/1234930","tags":["report"]},{"url":"https://bugzilla.suse.com/1234937","tags":["report"]},{"url":"https://bugzilla.suse.com/1234948","tags":["report"]},{"url":"https://bugzilla.suse.com/1234950","tags":["report"]},{"url":"https://bugzilla.suse.com/1234952","tags":["report"]},{"url":"https://bugzilla.suse.com/1234960","tags":["report"]},{"url":"https://bugzilla.suse.com/1234962","tags":["report"]},{"url":"https://bugzilla.suse.com/1234963","tags":["report"]},{"url":"https://bugzilla.suse.com/1234968","tags":["report"]},{"url":"https://bugzilla.suse.com/1234969","tags":["report"]},{"url":"https://bugzilla.suse.com/1234970","tags":["report"]},{"url":"https://bugzilla.suse.com/1234971","tags":["report"]},{"url":"https://bugzilla.suse.com/1234973","tags":["report"]},{"url":"https://bugzilla.suse.com/1234974","tags":["report"]},{"url":"https://bugzilla.suse.com/1234989","tags":["report"]},{"url":"https://bugzilla.suse.com/1234999","tags":["report"]},{"url":"https://bugzilla.suse.com/1235002","tags":["report"]},{"url":"https://bugzilla.suse.com/1235003","tags":["report"]},{"url":"https://bugzilla.suse.com/1235004","tags":["report"]},{"url":"https://bugzilla.suse.com/1235007","tags":["report"]},{"url":"https://bugzilla.suse.com/1235009","tags":["report"]},{"url":"https://bugzilla.suse.com/1235016","tags":["report"]},{"url":"https://bugzilla.suse.com/1235019","tags":["report"]},{"url":"https://bugzilla.suse.com/1235033","tags":["report"]},{"url":"https://bugzilla.suse.com/1235045","tags":["report"]},{"url":"https://bugzilla.suse.com/1235056","tags":["report"]},{"url":"https://bugzilla.suse.com/1235061","tags":["report"]},{"url":"https://bugzilla.suse.com/1235075","tags":["report"]},{"url":"https://bugzilla.suse.com/1235108","tags":["report"]},{"url":"https://bugzilla.suse.com/1235128","tags":["report"]},{"url":"https://bugzilla.suse.com/1235134","tags":["report"]},{"url":"https://bugzilla.suse.com/1235138","tags":["report"]},{"url":"https://bugzilla.suse.com/1235246","tags":["report"]},{"url":"https://bugzilla.suse.com/1235406","tags":["report"]},{"url":"https://bugzilla.suse.com/1235409","tags":["report"]},{"url":"https://bugzilla.suse.com/1235416","tags":["report"]},{"url":"https://bugzilla.suse.com/1235507","tags":["report"]},{"url":"https://bugzilla.suse.com/1235550","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8805","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250153-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250154-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53095","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012628","tags":["report"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1218470","tags":["report"]},{"url":"https://bugzilla.suse.com/1220355","tags":["report"]},{"url":"https://bugzilla.suse.com/1220711","tags":["report"]},{"url":"https://bugzilla.suse.com/1221326","tags":["report"]},{"url":"https://bugzilla.suse.com/1225897","tags":["report"]},{"url":"https://bugzilla.suse.com/1228592","tags":["report"]},{"url":"https://bugzilla.suse.com/1229833","tags":["report"]},{"url":"https://bugzilla.suse.com/1230557","tags":["report"]},{"url":"https://bugzilla.suse.com/1230807","tags":["report"]},{"url":"https://bugzilla.suse.com/1230827","tags":["report"]},{"url":"https://bugzilla.suse.com/1231016","tags":["report"]},{"url":"https://bugzilla.suse.com/1232087","tags":["report"]},{"url":"https://bugzilla.suse.com/1232157","tags":["report"]},{"url":"https://bugzilla.suse.com/1232158","tags":["report"]},{"url":"https://bugzilla.suse.com/1232166","tags":["report"]},{"url":"https://bugzilla.suse.com/1232882","tags":["report"]},{"url":"https://bugzilla.suse.com/1233055","tags":["report"]},{"url":"https://bugzilla.suse.com/1233112","tags":["report"]},{"url":"https://bugzilla.suse.com/1233201","tags":["report"]},{"url":"https://bugzilla.suse.com/1233485","tags":["report"]},{"url":"https://bugzilla.suse.com/1233488","tags":["report"]},{"url":"https://bugzilla.suse.com/1233523","tags":["report"]},{"url":"https://bugzilla.suse.com/1233547","tags":["report"]},{"url":"https://bugzilla.suse.com/1233550","tags":["report"]},{"url":"https://bugzilla.suse.com/1233568","tags":["report"]},{"url":"https://bugzilla.suse.com/1233638","tags":["report"]},{"url":"https://bugzilla.suse.com/1234078","tags":["report"]},{"url":"https://bugzilla.suse.com/1234085","tags":["report"]},{"url":"https://bugzilla.suse.com/1234223","tags":["report"]},{"url":"https://bugzilla.suse.com/1234619","tags":["report"]},{"url":"https://bugzilla.suse.com/1234635","tags":["report"]},{"url":"https://bugzilla.suse.com/1234825","tags":["report"]},{"url":"https://bugzilla.suse.com/1234863","tags":["report"]},{"url":"https://bugzilla.suse.com/1234887","tags":["report"]},{"url":"https://bugzilla.suse.com/1234888","tags":["report"]},{"url":"https://bugzilla.suse.com/1234893","tags":["report"]},{"url":"https://bugzilla.suse.com/1234898","tags":["report"]},{"url":"https://bugzilla.suse.com/1234901","tags":["report"]},{"url":"https://bugzilla.suse.com/1234906","tags":["report"]},{"url":"https://bugzilla.suse.com/1234923","tags":["report"]},{"url":"https://bugzilla.suse.com/1234931","tags":["report"]},{"url":"https://bugzilla.suse.com/1234934","tags":["report"]},{"url":"https://bugzilla.suse.com/1234957","tags":["report"]},{"url":"https://bugzilla.suse.com/1235000","tags":["report"]},{"url":"https://bugzilla.suse.com/1235011","tags":["report"]},{"url":"https://bugzilla.suse.com/1235031","tags":["report"]},{"url":"https://bugzilla.suse.com/1235032","tags":["report"]},{"url":"https://bugzilla.suse.com/1235035","tags":["report"]},{"url":"https://bugzilla.suse.com/1235037","tags":["report"]},{"url":"https://bugzilla.suse.com/1235038","tags":["report"]},{"url":"https://bugzilla.suse.com/1235039","tags":["report"]},{"url":"https://bugzilla.suse.com/1235040","tags":["report"]},{"url":"https://bugzilla.suse.com/1235042","tags":["report"]},{"url":"https://bugzilla.suse.com/1235043","tags":["report"]},{"url":"https://bugzilla.suse.com/1235046","tags":["report"]},{"url":"https://bugzilla.suse.com/1235050","tags":["report"]},{"url":"https://bugzilla.suse.com/1235051","tags":["report"]},{"url":"https://bugzilla.suse.com/1235053","tags":["report"]},{"url":"https://bugzilla.suse.com/1235054","tags":["report"]},{"url":"https://bugzilla.suse.com/1235057","tags":["report"]},{"url":"https://bugzilla.suse.com/1235059","tags":["report"]},{"url":"https://bugzilla.suse.com/1235065","tags":["report"]},{"url":"https://bugzilla.suse.com/1235070","tags":["report"]},{"url":"https://bugzilla.suse.com/1235073","tags":["report"]},{"url":"https://bugzilla.suse.com/1235100","tags":["report"]},{"url":"https://bugzilla.suse.com/1235112","tags":["report"]},{"url":"https://bugzilla.suse.com/1235115","tags":["report"]},{"url":"https://bugzilla.suse.com/1235117","tags":["report"]},{"url":"https://bugzilla.suse.com/1235122","tags":["report"]},{"url":"https://bugzilla.suse.com/1235123","tags":["report"]},{"url":"https://bugzilla.suse.com/1235125","tags":["report"]},{"url":"https://bugzilla.suse.com/1235132","tags":["report"]},{"url":"https://bugzilla.suse.com/1235133","tags":["report"]},{"url":"https://bugzilla.suse.com/1235155","tags":["report"]},{"url":"https://bugzilla.suse.com/1235160","tags":["report"]},{"url":"https://bugzilla.suse.com/1235219","tags":["report"]},{"url":"https://bugzilla.suse.com/1235220","tags":["report"]},{"url":"https://bugzilla.suse.com/1235222","tags":["report"]},{"url":"https://bugzilla.suse.com/1235223","tags":["report"]},{"url":"https://bugzilla.suse.com/1235224","tags":["report"]},{"url":"https://bugzilla.suse.com/1235227","tags":["report"]},{"url":"https://bugzilla.suse.com/1235241","tags":["report"]},{"url":"https://bugzilla.suse.com/1235249","tags":["report"]},{"url":"https://bugzilla.suse.com/1235251","tags":["report"]},{"url":"https://bugzilla.suse.com/1235252","tags":["report"]},{"url":"https://bugzilla.suse.com/1235389","tags":["report"]},{"url":"https://bugzilla.suse.com/1235391","tags":["report"]},{"url":"https://bugzilla.suse.com/1235410","tags":["report"]},{"url":"https://bugzilla.suse.com/1235412","tags":["report"]},{"url":"https://bugzilla.suse.com/1235413","tags":["report"]},{"url":"https://bugzilla.suse.com/1235415","tags":["report"]},{"url":"https://bugzilla.suse.com/1235417","tags":["report"]},{"url":"https://bugzilla.suse.com/1235423","tags":["report"]},{"url":"https://bugzilla.suse.com/1235424","tags":["report"]},{"url":"https://bugzilla.suse.com/1235425","tags":["report"]},{"url":"https://bugzilla.suse.com/1235426","tags":["report"]},{"url":"https://bugzilla.suse.com/1235427","tags":["report"]},{"url":"https://bugzilla.suse.com/1235428","tags":["report"]},{"url":"https://bugzilla.suse.com/1235429","tags":["report"]},{"url":"https://bugzilla.suse.com/1235433","tags":["report"]},{"url":"https://bugzilla.suse.com/1235437","tags":["report"]},{"url":"https://bugzilla.suse.com/1235439","tags":["report"]},{"url":"https://bugzilla.suse.com/1235444","tags":["report"]},{"url":"https://bugzilla.suse.com/1235445","tags":["report"]},{"url":"https://bugzilla.suse.com/1235449","tags":["report"]},{"url":"https://bugzilla.suse.com/1235451","tags":["report"]},{"url":"https://bugzilla.suse.com/1235454","tags":["report"]},{"url":"https://bugzilla.suse.com/1235458","tags":["report"]},{"url":"https://bugzilla.suse.com/1235459","tags":["report"]},{"url":"https://bugzilla.suse.com/1235464","tags":["report"]},{"url":"https://bugzilla.suse.com/1235466","tags":["report"]},{"url":"https://bugzilla.suse.com/1235473","tags":["report"]},{"url":"https://bugzilla.suse.com/1235479","tags":["report"]},{"url":"https://bugzilla.suse.com/1235480","tags":["report"]},{"url":"https://bugzilla.suse.com/1235483","tags":["report"]},{"url":"https://bugzilla.suse.com/1235486","tags":["report"]},{"url":"https://bugzilla.suse.com/1235488","tags":["report"]},{"url":"https://bugzilla.suse.com/1235491","tags":["report"]},{"url":"https://bugzilla.suse.com/1235494","tags":["report"]},{"url":"https://bugzilla.suse.com/1235495","tags":["report"]},{"url":"https://bugzilla.suse.com/1235496","tags":["report"]},{"url":"https://bugzilla.suse.com/1235497","tags":["report"]},{"url":"https://bugzilla.suse.com/1235500","tags":["report"]},{"url":"https://bugzilla.suse.com/1235502","tags":["report"]},{"url":"https://bugzilla.suse.com/1235503","tags":["report"]},{"url":"https://bugzilla.suse.com/1235519","tags":["report"]},{"url":"https://bugzilla.suse.com/1235520","tags":["report"]},{"url":"https://bugzilla.suse.com/1235521","tags":["report"]},{"url":"https://bugzilla.suse.com/1235523","tags":["report"]},{"url":"https://bugzilla.suse.com/1235526","tags":["report"]},{"url":"https://bugzilla.suse.com/1235528","tags":["report"]},{"url":"https://bugzilla.suse.com/1235532","tags":["report"]},{"url":"https://bugzilla.suse.com/1235533","tags":["report"]},{"url":"https://bugzilla.suse.com/1235534","tags":["report"]},{"url":"https://bugzilla.suse.com/1235537","tags":["report"]},{"url":"https://bugzilla.suse.com/1235538","tags":["report"]},{"url":"https://bugzilla.suse.com/1235552","tags":["report"]},{"url":"https://bugzilla.suse.com/1235555","tags":["report"]},{"url":"https://bugzilla.suse.com/1235557","tags":["report"]},{"url":"https://bugzilla.suse.com/1235563","tags":["report"]},{"url":"https://bugzilla.suse.com/1235564","tags":["report"]},{"url":"https://bugzilla.suse.com/1235565","tags":["report"]},{"url":"https://bugzilla.suse.com/1235568","tags":["report"]},{"url":"https://bugzilla.suse.com/1235570","tags":["report"]},{"url":"https://bugzilla.suse.com/1235571","tags":["report"]},{"url":"https://bugzilla.suse.com/1235577","tags":["report"]},{"url":"https://bugzilla.suse.com/1235584","tags":["report"]},{"url":"https://bugzilla.suse.com/1235587","tags":["report"]},{"url":"https://bugzilla.suse.com/1235611","tags":["report"]},{"url":"https://bugzilla.suse.com/1235616","tags":["report"]},{"url":"https://bugzilla.suse.com/1235622","tags":["report"]},{"url":"https://bugzilla.suse.com/1235627","tags":["report"]},{"url":"https://bugzilla.suse.com/1235632","tags":["report"]},{"url":"https://bugzilla.suse.com/1235635","tags":["report"]},{"url":"https://bugzilla.suse.com/1235641","tags":["report"]},{"url":"https://bugzilla.suse.com/1235643","tags":["report"]},{"url":"https://bugzilla.suse.com/1235645","tags":["report"]},{"url":"https://bugzilla.suse.com/1235646","tags":["report"]},{"url":"https://bugzilla.suse.com/1235647","tags":["report"]},{"url":"https://bugzilla.suse.com/1235650","tags":["report"]},{"url":"https://bugzilla.suse.com/1235653","tags":["report"]},{"url":"https://bugzilla.suse.com/1235657","tags":["report"]},{"url":"https://bugzilla.suse.com/1235663","tags":["report"]},{"url":"https://bugzilla.suse.com/1235700","tags":["report"]},{"url":"https://bugzilla.suse.com/1235705","tags":["report"]},{"url":"https://bugzilla.suse.com/1235707","tags":["report"]},{"url":"https://bugzilla.suse.com/1235708","tags":["report"]},{"url":"https://bugzilla.suse.com/1235710","tags":["report"]},{"url":"https://bugzilla.suse.com/1235714","tags":["report"]},{"url":"https://bugzilla.suse.com/1235716","tags":["report"]},{"url":"https://bugzilla.suse.com/1235720","tags":["report"]},{"url":"https://bugzilla.suse.com/1235723","tags":["report"]},{"url":"https://bugzilla.suse.com/1235727","tags":["report"]},{"url":"https://bugzilla.suse.com/1235730","tags":["report"]},{"url":"https://bugzilla.suse.com/1235737","tags":["report"]},{"url":"https://bugzilla.suse.com/1235739","tags":["report"]},{"url":"https://bugzilla.suse.com/1235745","tags":["report"]},{"url":"https://bugzilla.suse.com/1235747","tags":["report"]},{"url":"https://bugzilla.suse.com/1235750","tags":["report"]},{"url":"https://bugzilla.suse.com/1235753","tags":["report"]},{"url":"https://bugzilla.suse.com/1235759","tags":["report"]},{"url":"https://bugzilla.suse.com/1235764","tags":["report"]},{"url":"https://bugzilla.suse.com/1235768","tags":["report"]},{"url":"https://bugzilla.suse.com/1235776","tags":["report"]},{"url":"https://bugzilla.suse.com/1235777","tags":["report"]},{"url":"https://bugzilla.suse.com/1235778","tags":["report"]},{"url":"https://bugzilla.suse.com/1235779","tags":["report"]},{"url":"https://bugzilla.suse.com/1235793","tags":["report"]},{"url":"https://bugzilla.suse.com/1235798","tags":["report"]},{"url":"https://bugzilla.suse.com/1235806","tags":["report"]},{"url":"https://bugzilla.suse.com/1235808","tags":["report"]},{"url":"https://bugzilla.suse.com/1235812","tags":["report"]},{"url":"https://bugzilla.suse.com/1235814","tags":["report"]},{"url":"https://bugzilla.suse.com/1235818","tags":["report"]},{"url":"https://bugzilla.suse.com/1235842","tags":["report"]},{"url":"https://bugzilla.suse.com/1235894","tags":["report"]},{"url":"https://bugzilla.suse.com/1235902","tags":["report"]},{"url":"https://bugzilla.suse.com/1235903","tags":["report"]},{"url":"https://bugzilla.suse.com/1235906","tags":["report"]},{"url":"https://bugzilla.suse.com/1235918","tags":["report"]},{"url":"https://bugzilla.suse.com/1235919","tags":["report"]},{"url":"https://bugzilla.suse.com/1235920","tags":["report"]},{"url":"https://bugzilla.suse.com/1235924","tags":["report"]},{"url":"https://bugzilla.suse.com/1235940","tags":["report"]},{"url":"https://bugzilla.suse.com/1235946","tags":["report"]},{"url":"https://bugzilla.suse.com/1235952","tags":["report"]},{"url":"https://bugzilla.suse.com/1235964","tags":["report"]},{"url":"https://bugzilla.suse.com/1235965","tags":["report"]},{"url":"https://bugzilla.suse.com/1235967","tags":["report"]},{"url":"https://bugzilla.suse.com/1235969","tags":["report"]},{"url":"https://bugzilla.suse.com/1235976","tags":["report"]},{"url":"https://bugzilla.suse.com/1235977","tags":["report"]},{"url":"https://bugzilla.suse.com/1236078","tags":["report"]},{"url":"https://bugzilla.suse.com/1236080","tags":["report"]},{"url":"https://bugzilla.suse.com/1236082","tags":["report"]},{"url":"https://bugzilla.suse.com/1236088","tags":["report"]},{"url":"https://bugzilla.suse.com/1236090","tags":["report"]},{"url":"https://bugzilla.suse.com/1236091","tags":["report"]},{"url":"https://bugzilla.suse.com/1236096","tags":["report"]},{"url":"https://bugzilla.suse.com/1236097","tags":["report"]},{"url":"https://bugzilla.suse.com/1236098","tags":["report"]},{"url":"https://bugzilla.suse.com/1236101","tags":["report"]},{"url":"https://bugzilla.suse.com/1236102","tags":["report"]},{"url":"https://bugzilla.suse.com/1236104","tags":["report"]},{"url":"https://bugzilla.suse.com/1236106","tags":["report"]},{"url":"https://bugzilla.suse.com/1236120","tags":["report"]},{"url":"https://bugzilla.suse.com/1236125","tags":["report"]},{"url":"https://bugzilla.suse.com/1236131","tags":["report"]},{"url":"https://bugzilla.suse.com/1236138","tags":["report"]},{"url":"https://bugzilla.suse.com/1236143","tags":["report"]},{"url":"https://bugzilla.suse.com/1236144","tags":["report"]},{"url":"https://bugzilla.suse.com/1236145","tags":["report"]},{"url":"https://bugzilla.suse.com/1236168","tags":["report"]},{"url":"https://bugzilla.suse.com/1236178","tags":["report"]},{"url":"https://bugzilla.suse.com/1236180","tags":["report"]},{"url":"https://bugzilla.suse.com/1236181","tags":["report"]},{"url":"https://bugzilla.suse.com/1236190","tags":["report"]},{"url":"https://bugzilla.suse.com/1236198","tags":["report"]},{"url":"https://bugzilla.suse.com/1236227","tags":["report"]},{"url":"https://bugzilla.suse.com/1236248","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520165-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226980","tags":["report"]},{"url":"https://bugzilla.suse.com/1232101","tags":["report"]},{"url":"https://bugzilla.suse.com/1232161","tags":["report"]},{"url":"https://bugzilla.suse.com/1233778","tags":["report"]},{"url":"https://bugzilla.suse.com/1234683","tags":["report"]},{"url":"https://bugzilla.suse.com/1234693","tags":["report"]},{"url":"https://bugzilla.suse.com/1234947","tags":["report"]},{"url":"https://bugzilla.suse.com/1235001","tags":["report"]},{"url":"https://bugzilla.suse.com/1235217","tags":["report"]},{"url":"https://bugzilla.suse.com/1235230","tags":["report"]},{"url":"https://bugzilla.suse.com/1235390","tags":["report"]},{"url":"https://bugzilla.suse.com/1235418","tags":["report"]},{"url":"https://bugzilla.suse.com/1235430","tags":["report"]},{"url":"https://bugzilla.suse.com/1235487","tags":["report"]},{"url":"https://bugzilla.suse.com/1235489","tags":["report"]},{"url":"https://bugzilla.suse.com/1235498","tags":["report"]},{"url":"https://bugzilla.suse.com/1235545","tags":["report"]},{"url":"https://bugzilla.suse.com/1235578","tags":["report"]},{"url":"https://bugzilla.suse.com/1235582","tags":["report"]},{"url":"https://bugzilla.suse.com/1235583","tags":["report"]},{"url":"https://bugzilla.suse.com/1235612","tags":["report"]},{"url":"https://bugzilla.suse.com/1235638","tags":["report"]},{"url":"https://bugzilla.suse.com/1235656","tags":["report"]},{"url":"https://bugzilla.suse.com/1235686","tags":["report"]},{"url":"https://bugzilla.suse.com/1235865","tags":["report"]},{"url":"https://bugzilla.suse.com/1235941","tags":["report"]},{"url":"https://bugzilla.suse.com/1235948","tags":["report"]},{"url":"https://bugzilla.suse.com/1236127","tags":["report"]},{"url":"https://bugzilla.suse.com/1236160","tags":["report"]},{"url":"https://bugzilla.suse.com/1236161","tags":["report"]},{"url":"https://bugzilla.suse.com/1236163","tags":["report"]},{"url":"https://bugzilla.suse.com/1236182","tags":["report"]},{"url":"https://bugzilla.suse.com/1236192","tags":["report"]},{"url":"https://bugzilla.suse.com/1236245","tags":["report"]},{"url":"https://bugzilla.suse.com/1236247","tags":["report"]},{"url":"https://bugzilla.suse.com/1236260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236262","tags":["report"]},{"url":"https://bugzilla.suse.com/1236628","tags":["report"]},{"url":"https://bugzilla.suse.com/1236688","tags":["report"]},{"url":"https://bugzilla.suse.com/1236696","tags":["report"]},{"url":"https://bugzilla.suse.com/1236703","tags":["report"]},{"url":"https://bugzilla.suse.com/1236732","tags":["report"]},{"url":"https://bugzilla.suse.com/1236733","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21682","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520166-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1181674","tags":["report"]},{"url":"https://bugzilla.suse.com/1207948","tags":["report"]},{"url":"https://bugzilla.suse.com/1216702","tags":["report"]},{"url":"https://bugzilla.suse.com/1219170","tags":["report"]},{"url":"https://bugzilla.suse.com/1219596","tags":["report"]},{"url":"https://bugzilla.suse.com/1220021","tags":["report"]},{"url":"https://bugzilla.suse.com/1220328","tags":["report"]},{"url":"https://bugzilla.suse.com/1220430","tags":["report"]},{"url":"https://bugzilla.suse.com/1221044","tags":["report"]},{"url":"https://bugzilla.suse.com/1221303","tags":["report"]},{"url":"https://bugzilla.suse.com/1221858","tags":["report"]},{"url":"https://bugzilla.suse.com/1222426","tags":["report"]},{"url":"https://bugzilla.suse.com/1222608","tags":["report"]},{"url":"https://bugzilla.suse.com/1222721","tags":["report"]},{"url":"https://bugzilla.suse.com/1222775","tags":["report"]},{"url":"https://bugzilla.suse.com/1222780","tags":["report"]},{"url":"https://bugzilla.suse.com/1223020","tags":["report"]},{"url":"https://bugzilla.suse.com/1223023","tags":["report"]},{"url":"https://bugzilla.suse.com/1223024","tags":["report"]},{"url":"https://bugzilla.suse.com/1223038","tags":["report"]},{"url":"https://bugzilla.suse.com/1223039","tags":["report"]},{"url":"https://bugzilla.suse.com/1223041","tags":["report"]},{"url":"https://bugzilla.suse.com/1223046","tags":["report"]},{"url":"https://bugzilla.suse.com/1223051","tags":["report"]},{"url":"https://bugzilla.suse.com/1223052","tags":["report"]},{"url":"https://bugzilla.suse.com/1223058","tags":["report"]},{"url":"https://bugzilla.suse.com/1223061","tags":["report"]},{"url":"https://bugzilla.suse.com/1223076","tags":["report"]},{"url":"https://bugzilla.suse.com/1223113","tags":["report"]},{"url":"https://bugzilla.suse.com/1223187","tags":["report"]},{"url":"https://bugzilla.suse.com/1223285","tags":["report"]},{"url":"https://bugzilla.suse.com/1223315","tags":["report"]},{"url":"https://bugzilla.suse.com/1223591","tags":["report"]},{"url":"https://bugzilla.suse.com/1223592","tags":["report"]},{"url":"https://bugzilla.suse.com/1223633","tags":["report"]},{"url":"https://bugzilla.suse.com/1223637","tags":["report"]},{"url":"https://bugzilla.suse.com/1223641","tags":["report"]},{"url":"https://bugzilla.suse.com/1223649","tags":["report"]},{"url":"https://bugzilla.suse.com/1223650","tags":["report"]},{"url":"https://bugzilla.suse.com/1223651","tags":["report"]},{"url":"https://bugzilla.suse.com/1223652","tags":["report"]},{"url":"https://bugzilla.suse.com/1223654","tags":["report"]},{"url":"https://bugzilla.suse.com/1223660","tags":["report"]},{"url":"https://bugzilla.suse.com/1223661","tags":["report"]},{"url":"https://bugzilla.suse.com/1223665","tags":["report"]},{"url":"https://bugzilla.suse.com/1223666","tags":["report"]},{"url":"https://bugzilla.suse.com/1223671","tags":["report"]},{"url":"https://bugzilla.suse.com/1223675","tags":["report"]},{"url":"https://bugzilla.suse.com/1223677","tags":["report"]},{"url":"https://bugzilla.suse.com/1223678","tags":["report"]},{"url":"https://bugzilla.suse.com/1223696","tags":["report"]},{"url":"https://bugzilla.suse.com/1223698","tags":["report"]},{"url":"https://bugzilla.suse.com/1223705","tags":["report"]},{"url":"https://bugzilla.suse.com/1223712","tags":["report"]},{"url":"https://bugzilla.suse.com/1223718","tags":["report"]},{"url":"https://bugzilla.suse.com/1223728","tags":["report"]},{"url":"https://bugzilla.suse.com/1223739","tags":["report"]},{"url":"https://bugzilla.suse.com/1223741","tags":["report"]},{"url":"https://bugzilla.suse.com/1223744","tags":["report"]},{"url":"https://bugzilla.suse.com/1223747","tags":["report"]},{"url":"https://bugzilla.suse.com/1223748","tags":["report"]},{"url":"https://bugzilla.suse.com/1223750","tags":["report"]},{"url":"https://bugzilla.suse.com/1223752","tags":["report"]},{"url":"https://bugzilla.suse.com/1223754","tags":["report"]},{"url":"https://bugzilla.suse.com/1223757","tags":["report"]},{"url":"https://bugzilla.suse.com/1223759","tags":["report"]},{"url":"https://bugzilla.suse.com/1223761","tags":["report"]},{"url":"https://bugzilla.suse.com/1223762","tags":["report"]},{"url":"https://bugzilla.suse.com/1223782","tags":["report"]},{"url":"https://bugzilla.suse.com/1223787","tags":["report"]},{"url":"https://bugzilla.suse.com/1223788","tags":["report"]},{"url":"https://bugzilla.suse.com/1223789","tags":["report"]},{"url":"https://bugzilla.suse.com/1223790","tags":["report"]},{"url":"https://bugzilla.suse.com/1223802","tags":["report"]},{"url":"https://bugzilla.suse.com/1223805","tags":["report"]},{"url":"https://bugzilla.suse.com/1223827","tags":["report"]},{"url":"https://bugzilla.suse.com/1223831","tags":["report"]},{"url":"https://bugzilla.suse.com/1223834","tags":["report"]},{"url":"https://bugzilla.suse.com/1223869","tags":["report"]},{"url":"https://bugzilla.suse.com/1223874","tags":["report"]},{"url":"https://bugzilla.suse.com/1224174","tags":["report"]},{"url":"https://bugzilla.suse.com/1224177","tags":["report"]},{"url":"https://bugzilla.suse.com/1224180","tags":["report"]},{"url":"https://bugzilla.suse.com/1224423","tags":["report"]},{"url":"https://bugzilla.suse.com/1224432","tags":["report"]},{"url":"https://bugzilla.suse.com/1224433","tags":["report"]},{"url":"https://bugzilla.suse.com/1224437","tags":["report"]},{"url":"https://bugzilla.suse.com/1224438","tags":["report"]},{"url":"https://bugzilla.suse.com/1224443","tags":["report"]},{"url":"https://bugzilla.suse.com/1224445","tags":["report"]},{"url":"https://bugzilla.suse.com/1224449","tags":["report"]},{"url":"https://bugzilla.suse.com/1224479","tags":["report"]},{"url":"https://bugzilla.suse.com/1224480","tags":["report"]},{"url":"https://bugzilla.suse.com/1224482","tags":["report"]},{"url":"https://bugzilla.suse.com/1224486","tags":["report"]},{"url":"https://bugzilla.suse.com/1224487","tags":["report"]},{"url":"https://bugzilla.suse.com/1224491","tags":["report"]},{"url":"https://bugzilla.suse.com/1224492","tags":["report"]},{"url":"https://bugzilla.suse.com/1224494","tags":["report"]},{"url":"https://bugzilla.suse.com/1224495","tags":["report"]},{"url":"https://bugzilla.suse.com/1224500","tags":["report"]},{"url":"https://bugzilla.suse.com/1224501","tags":["report"]},{"url":"https://bugzilla.suse.com/1224504","tags":["report"]},{"url":"https://bugzilla.suse.com/1224505","tags":["report"]},{"url":"https://bugzilla.suse.com/1224506","tags":["report"]},{"url":"https://bugzilla.suse.com/1224507","tags":["report"]},{"url":"https://bugzilla.suse.com/1224508","tags":["report"]},{"url":"https://bugzilla.suse.com/1224509","tags":["report"]},{"url":"https://bugzilla.suse.com/1224513","tags":["report"]},{"url":"https://bugzilla.suse.com/1224517","tags":["report"]},{"url":"https://bugzilla.suse.com/1224519","tags":["report"]},{"url":"https://bugzilla.suse.com/1224521","tags":["report"]},{"url":"https://bugzilla.suse.com/1224524","tags":["report"]},{"url":"https://bugzilla.suse.com/1224526","tags":["report"]},{"url":"https://bugzilla.suse.com/1224537","tags":["report"]},{"url":"https://bugzilla.suse.com/1224542","tags":["report"]},{"url":"https://bugzilla.suse.com/1224546","tags":["report"]},{"url":"https://bugzilla.suse.com/1224552","tags":["report"]},{"url":"https://bugzilla.suse.com/1224555","tags":["report"]},{"url":"https://bugzilla.suse.com/1224557","tags":["report"]},{"url":"https://bugzilla.suse.com/1224558","tags":["report"]},{"url":"https://bugzilla.suse.com/1224559","tags":["report"]},{"url":"https://bugzilla.suse.com/1224562","tags":["report"]},{"url":"https://bugzilla.suse.com/1224566","tags":["report"]},{"url":"https://bugzilla.suse.com/1224567","tags":["report"]},{"url":"https://bugzilla.suse.com/1224568","tags":["report"]},{"url":"https://bugzilla.suse.com/1224569","tags":["report"]},{"url":"https://bugzilla.suse.com/1224571","tags":["report"]},{"url":"https://bugzilla.suse.com/1224573","tags":["report"]},{"url":"https://bugzilla.suse.com/1224576","tags":["report"]},{"url":"https://bugzilla.suse.com/1224577","tags":["report"]},{"url":"https://bugzilla.suse.com/1224578","tags":["report"]},{"url":"https://bugzilla.suse.com/1224579","tags":["report"]},{"url":"https://bugzilla.suse.com/1224582","tags":["report"]},{"url":"https://bugzilla.suse.com/1224585","tags":["report"]},{"url":"https://bugzilla.suse.com/1224586","tags":["report"]},{"url":"https://bugzilla.suse.com/1224587","tags":["report"]},{"url":"https://bugzilla.suse.com/1224588","tags":["report"]},{"url":"https://bugzilla.suse.com/1224592","tags":["report"]},{"url":"https://bugzilla.suse.com/1224596","tags":["report"]},{"url":"https://bugzilla.suse.com/1224598","tags":["report"]},{"url":"https://bugzilla.suse.com/1224600","tags":["report"]},{"url":"https://bugzilla.suse.com/1224601","tags":["report"]},{"url":"https://bugzilla.suse.com/1224603","tags":["report"]},{"url":"https://bugzilla.suse.com/1224605","tags":["report"]},{"url":"https://bugzilla.suse.com/1224607","tags":["report"]},{"url":"https://bugzilla.suse.com/1224609","tags":["report"]},{"url":"https://bugzilla.suse.com/1224611","tags":["report"]},{"url":"https://bugzilla.suse.com/1224613","tags":["report"]},{"url":"https://bugzilla.suse.com/1224615","tags":["report"]},{"url":"https://bugzilla.suse.com/1224617","tags":["report"]},{"url":"https://bugzilla.suse.com/1224618","tags":["report"]},{"url":"https://bugzilla.suse.com/1224620","tags":["report"]},{"url":"https://bugzilla.suse.com/1224622","tags":["report"]},{"url":"https://bugzilla.suse.com/1224623","tags":["report"]},{"url":"https://bugzilla.suse.com/1224624","tags":["report"]},{"url":"https://bugzilla.suse.com/1224626","tags":["report"]},{"url":"https://bugzilla.suse.com/1224627","tags":["report"]},{"url":"https://bugzilla.suse.com/1224629","tags":["report"]},{"url":"https://bugzilla.suse.com/1224630","tags":["report"]},{"url":"https://bugzilla.suse.com/1224632","tags":["report"]},{"url":"https://bugzilla.suse.com/1224633","tags":["report"]},{"url":"https://bugzilla.suse.com/1224634","tags":["report"]},{"url":"https://bugzilla.suse.com/1224637","tags":["report"]},{"url":"https://bugzilla.suse.com/1224639","tags":["report"]},{"url":"https://bugzilla.suse.com/1224640","tags":["report"]},{"url":"https://bugzilla.suse.com/1224643","tags":["report"]},{"url":"https://bugzilla.suse.com/1224644","tags":["report"]},{"url":"https://bugzilla.suse.com/1224646","tags":["report"]},{"url":"https://bugzilla.suse.com/1224647","tags":["report"]},{"url":"https://bugzilla.suse.com/1224650","tags":["report"]},{"url":"https://bugzilla.suse.com/1224651","tags":["report"]},{"url":"https://bugzilla.suse.com/1224653","tags":["report"]},{"url":"https://bugzilla.suse.com/1224654","tags":["report"]},{"url":"https://bugzilla.suse.com/1224657","tags":["report"]},{"url":"https://bugzilla.suse.com/1224660","tags":["report"]},{"url":"https://bugzilla.suse.com/1224663","tags":["report"]},{"url":"https://bugzilla.suse.com/1224665","tags":["report"]},{"url":"https://bugzilla.suse.com/1224666","tags":["report"]},{"url":"https://bugzilla.suse.com/1224671","tags":["report"]},{"url":"https://bugzilla.suse.com/1224675","tags":["report"]},{"url":"https://bugzilla.suse.com/1224676","tags":["report"]},{"url":"https://bugzilla.suse.com/1224677","tags":["report"]},{"url":"https://bugzilla.suse.com/1224680","tags":["report"]},{"url":"https://bugzilla.suse.com/1224681","tags":["report"]},{"url":"https://bugzilla.suse.com/1224682","tags":["report"]},{"url":"https://bugzilla.suse.com/1224683","tags":["report"]},{"url":"https://bugzilla.suse.com/1224685","tags":["report"]},{"url":"https://bugzilla.suse.com/1224686","tags":["report"]},{"url":"https://bugzilla.suse.com/1224687","tags":["report"]},{"url":"https://bugzilla.suse.com/1224688","tags":["report"]},{"url":"https://bugzilla.suse.com/1224692","tags":["report"]},{"url":"https://bugzilla.suse.com/1224696","tags":["report"]},{"url":"https://bugzilla.suse.com/1224697","tags":["report"]},{"url":"https://bugzilla.suse.com/1224699","tags":["report"]},{"url":"https://bugzilla.suse.com/1224701","tags":["report"]},{"url":"https://bugzilla.suse.com/1224703","tags":["report"]},{"url":"https://bugzilla.suse.com/1224704","tags":["report"]},{"url":"https://bugzilla.suse.com/1224705","tags":["report"]},{"url":"https://bugzilla.suse.com/1224706","tags":["report"]},{"url":"https://bugzilla.suse.com/1224707","tags":["report"]},{"url":"https://bugzilla.suse.com/1224709","tags":["report"]},{"url":"https://bugzilla.suse.com/1224710","tags":["report"]},{"url":"https://bugzilla.suse.com/1224712","tags":["report"]},{"url":"https://bugzilla.suse.com/1224714","tags":["report"]},{"url":"https://bugzilla.suse.com/1224716","tags":["report"]},{"url":"https://bugzilla.suse.com/1224717","tags":["report"]},{"url":"https://bugzilla.suse.com/1224719","tags":["report"]},{"url":"https://bugzilla.suse.com/1224722","tags":["report"]},{"url":"https://bugzilla.suse.com/1224723","tags":["report"]},{"url":"https://bugzilla.suse.com/1224728","tags":["report"]},{"url":"https://bugzilla.suse.com/1224729","tags":["report"]},{"url":"https://bugzilla.suse.com/1224730","tags":["report"]},{"url":"https://bugzilla.suse.com/1224731","tags":["report"]},{"url":"https://bugzilla.suse.com/1224732","tags":["report"]},{"url":"https://bugzilla.suse.com/1224733","tags":["report"]},{"url":"https://bugzilla.suse.com/1224736","tags":["report"]},{"url":"https://bugzilla.suse.com/1224738","tags":["report"]},{"url":"https://bugzilla.suse.com/1224739","tags":["report"]},{"url":"https://bugzilla.suse.com/1224740","tags":["report"]},{"url":"https://bugzilla.suse.com/1224741","tags":["report"]},{"url":"https://bugzilla.suse.com/1224747","tags":["report"]},{"url":"https://bugzilla.suse.com/1224749","tags":["report"]},{"url":"https://bugzilla.suse.com/1224803","tags":["report"]},{"url":"https://bugzilla.suse.com/1224804","tags":["report"]},{"url":"https://bugzilla.suse.com/1225502","tags":["report"]},{"url":"https://bugzilla.suse.com/1225579","tags":["report"]},{"url":"https://bugzilla.suse.com/1225593","tags":["report"]},{"url":"https://bugzilla.suse.com/1225692","tags":["report"]},{"url":"https://bugzilla.suse.com/1225694","tags":["report"]},{"url":"https://bugzilla.suse.com/1225695","tags":["report"]},{"url":"https://bugzilla.suse.com/1225698","tags":["report"]},{"url":"https://bugzilla.suse.com/1225699","tags":["report"]},{"url":"https://bugzilla.suse.com/1225704","tags":["report"]},{"url":"https://bugzilla.suse.com/1225705","tags":["report"]},{"url":"https://bugzilla.suse.com/1225708","tags":["report"]},{"url":"https://bugzilla.suse.com/1225710","tags":["report"]},{"url":"https://bugzilla.suse.com/1225715","tags":["report"]},{"url":"https://bugzilla.suse.com/1225720","tags":["report"]},{"url":"https://bugzilla.suse.com/1225722","tags":["report"]},{"url":"https://bugzilla.suse.com/1225728","tags":["report"]},{"url":"https://bugzilla.suse.com/1225734","tags":["report"]},{"url":"https://bugzilla.suse.com/1225735","tags":["report"]},{"url":"https://bugzilla.suse.com/1225736","tags":["report"]},{"url":"https://bugzilla.suse.com/1225747","tags":["report"]},{"url":"https://bugzilla.suse.com/1225748","tags":["report"]},{"url":"https://bugzilla.suse.com/1225749","tags":["report"]},{"url":"https://bugzilla.suse.com/1225750","tags":["report"]},{"url":"https://bugzilla.suse.com/1225769","tags":["report"]},{"url":"https://bugzilla.suse.com/1225775","tags":["report"]},{"url":"https://bugzilla.suse.com/1229025","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36959","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520248-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520249-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53201","tags":["report"]},{"url":"https://git.kernel.org/linus/6a057072ddd127255350357dd880903e8fa23f36","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7310-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7449-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7450-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7451-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7452-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7453-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7449-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-49034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-0927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-52332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56621","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-56672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57798","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","status":"published","published":"2024-12-27T13:49:42.96Z","modified":"2026-10-30T12:20:12.879Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-51873","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","status":"published","published":"2024-12-27T13:49:42Z","modified":"2026-10-30T12:20:12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:59:12.333329Z"}],"ghsa":[{"id":"GHSA-9pwp-p2rw-34f5","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","status":"published","published":"2024-12-27T15:31:51Z","modified":"2026-10-30T15:33:00Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:14:45.22429Z"}],"nvd":[{"id":"CVE-2024-53201","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","status":"published","published":"2024-12-27T14:15:27.853Z","modified":"2026-10-30T13:17:45.563Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:41.091507Z"}],"osv":[{"id":"AZL-55294","title":"CVE-2024-53201 affecting package kernel 6.6.161.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","status":"published","published":"2024-12-27T14:15:27Z","modified":"2026-11-05T14:17:08.032052443Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:20.996398Z"},{"id":"BELL-CVE-2024-53201","status":"published","published":"2025-01-01T05:59:09.740045Z","modified":"2026-06-25T07:15:45.751724053Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in\ndcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display:\nAdd null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\")\npartially fixed the null pointer dereference issue. However, in\ndcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and\nplane_state is accessed again through pipe_ctx. Multiple if statements\ndirectly call attributes of plane_state, leading to potential null\npointer dereference issues. This patch adds necessary null checks to\nensure stability.","status":"published","published":"2024-12-27T13:49:42.96Z","modified":"2026-11-01T02:30:57.091825423Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53201","description":"In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe  This commit addresses a null pointer dereference issue in dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display: Add null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\") partially fixed the null pointer dereference issue. However, in dcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and plane_state is accessed again through pipe_ctx. Multiple if statements directly call attributes of plane_state, leading to potential null pointer dereference issues. This patch adds necessary null checks to ensure stability.","status":"published","published":"2024-12-27T14:15:27.853Z","modified":"2026-10-31T09:47:36.553398489Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"OESA-2025-1093","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial out-of-bounds when buffer offset is invalid\n\nI found potencial out-of-bounds when buffer offset fields of a few requests\nis invalid. This patch set the minimum value of buffer offset field to\n-\u0026gt;Buffer offset to validate buffer length.(CVE-2024-26952)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()\n\nIf -\u0026gt;NameOffset of smb2_create_req is smaller than Buffer offset of\nsmb2_create_req, slab-out-of-bounds read can happen from smb2_open.\nThis patch set the minimum value of the name offset to the buffer offset\nto validate name length of smb2_create_req().(CVE-2024-26954)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \u0026quot;arbitrary runtime\u0026quot; (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-\u0026gt; ...\n   -\u0026gt; dsa_user_phy_read()\n      -\u0026gt; ds-\u0026gt;ops-\u0026gt;phy_read()\n         -\u0026gt; lan9303_phy_read()\n            -\u0026gt; chip-\u0026gt;ops-\u0026gt;phy_read()\n               -\u0026gt; lan9303_mdio_phy_read()\n                  -\u0026gt; dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp-\u0026gt;conduit-\u0026gt;dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev-\u0026gt;dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev-\u0026gt;dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds-\u0026gt;ops-\u0026gt;phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data.  All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit-\u0026gt;dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we\u0026apos;re no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\u0026quot;net: dsa: be compatible with masters which unregister on shutdown\u0026quot;)\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit-\u0026gt;dsa_ptr\n(one which doesn\u0026apos;t ensure that the interfaces aren\u0026apos;t up).(CVE-2024-49998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Vangogh: Fix kernel memory out of bounds write\n\nKASAN reports that the GPU metrics table allocated in\nvangogh_tables_init() is not large enough for the memset done in\nsmu_cmn_init_soft_gpu_metrics(). Condensed report follows:\n\n[   33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]\n[   33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067\n...\n[   33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G        W          6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544\n[   33.861816] Tainted: [W]=WARN\n[   33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023\n[   33.861822] Call Trace:\n[   33.861826]  \u0026lt;TASK\u0026gt;\n[   33.861829]  dump_stack_lvl+0x66/0x90\n[   33.861838]  print_report+0xce/0x620\n[   33.861853]  kasan_report+0xda/0x110\n[   33.862794]  kasan_check_range+0xfd/0x1a0\n[   33.862799]  __asan_memset+0x23/0x40\n[   33.862803]  smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.863306]  vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.864257]  vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.865682]  amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.866160]  amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.867135]  dev_attr_show+0x43/0xc0\n[   33.867147]  sysfs_kf_seq_show+0x1f1/0x3b0\n[   33.867155]  seq_read_iter+0x3f8/0x1140\n[   33.867173]  vfs_read+0x76c/0xc50\n[   33.867198]  ksys_read+0xfb/0x1d0\n[   33.867214]  do_syscall_64+0x90/0x160\n...\n[   33.867353] Allocated by task 378 on cpu 7 at 22.794876s:\n[   33.867358]  kasan_save_stack+0x33/0x50\n[   33.867364]  kasan_save_track+0x17/0x60\n[   33.867367]  __kasan_kmalloc+0x87/0x90\n[   33.867371]  vangogh_init_smc_tables+0x3f9/0x840 [amdgpu]\n[   33.867835]  smu_sw_init+0xa32/0x1850 [amdgpu]\n[   33.868299]  amdgpu_device_init+0x467b/0x8d90 [amdgpu]\n[   33.868733]  amdgpu_driver_load_kms+0x19/0xf0 [amdgpu]\n[   33.869167]  amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu]\n[   33.869608]  local_pci_probe+0xda/0x180\n[   33.869614]  pci_device_probe+0x43f/0x6b0\n\nEmpirically we can confirm that the former allocates 152 bytes for the\ntable, while the latter memsets the 168 large block.\n\nRoot cause appears that when GPU metrics tables for v2_4 parts were added\nit was not considered to enlarge the table to fit.\n\nThe fix in this patch is rather \u0026quot;brute force\u0026quot; and perhaps later should be\ndone in a smarter way, by extracting and consolidating the part version to\nsize logic to a common helper, instead of brute forcing the largest\npossible allocation. Nevertheless, for now this works and fixes the out of\nbounds write.\n\nv2:\n * Drop impossible v3_0 case. (Mario)\n\n(cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)(CVE-2024-50221)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()\n\nThe per-netns IP tunnel hash table is protected by the RTNL mutex and\nip_tunnel_find() is only called from the control path where the mutex is\ntaken.\n\nAdd a lockdep expression to hlist_for_each_entry_rcu() in\nip_tunnel_find() in order to validate that the mutex is held and to\nsilence the suspicious RCU usage warning [1].\n\n[1]\nWARNING: suspicious RCU usage\n6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted\n-----------------------------\nnet/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by ip/362:\n #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60\n\nstack backtrace:\nCPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xba/0x110\n lockdep_rcu_suspicious.cold+0x4f/0xd6\n ip_tunnel_find+0x435/0x4d0\n ip_tunnel_newlink+0x517/0x7a0\n ipgre_newlink+0x14c/0x170\n __rtnl_newlink+0x1173/0x19c0\n rtnl_newlink+0x6c/0xa0\n rtnetlink_rcv_msg+0x3cc/0xf60\n netlink_rcv_skb+0x171/0x450\n netlink_unicast+0x539/0x7f0\n netlink_sendmsg+0x8c1/0xd80\n ____sys_sendmsg+0x8f9/0xc20\n ___sys_sendmsg+0x197/0x1e0\n __sys_sendmsg+0x122/0x1f0\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-50304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in intel_hdcp_get_capability\n\nSometimes during hotplug scenario or suspend/resume scenario encoder is\nnot always initialized when intel_hdcp_get_capability add\na check to avoid kernel null pointer dereference.(CVE-2024-53051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnommu: pass NULL argument to vma_iter_prealloc()\n\nWhen deleting a vma entry from a maple tree, it has to pass NULL to\nvma_iter_prealloc() in order to calculate internal state of the tree, but\nit passed a wrong argument.  As a result, nommu kernels crashed upon\naccessing a vma iterator, such as acct_collect() reading the size of vma\nentries after do_munmap().\n\nThis commit fixes this issue by passing a right argument to the\npreallocation call.(CVE-2024-53109)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix NULL pointer dereference in alloc_pages_bulk_noprof\n\nWe triggered a NULL pointer dereference for ac.preferred_zoneref-\u0026gt;zone in\nalloc_pages_bulk_noprof() when the task is migrated between cpusets.\n\nWhen cpuset is enabled, in prepare_alloc_pages(), ac-\u0026gt;nodemask may be\n\u0026amp;current-\u0026gt;mems_allowed.  when first_zones_zonelist() is called to find\npreferred_zoneref, the ac-\u0026gt;nodemask may be modified concurrently if the\ntask is migrated between different cpusets.  Assuming we have 2 NUMA Node,\nwhen traversing Node1 in ac-\u0026gt;zonelist, the nodemask is 2, and when\ntraversing Node2 in ac-\u0026gt;zonelist, the nodemask is 1.  As a result, the\nac-\u0026gt;preferred_zoneref points to NULL zone.\n\nIn alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a\nallowable zone and calls zonelist_node_idx(ac.preferred_zoneref), leading\nto NULL pointer dereference.\n\n__alloc_pages_noprof() fixes this issue by checking NULL pointer in commit\nea57485af8f4 (\u0026quot;mm, page_alloc: fix check for NULL preferred_zone\u0026quot;) and\ncommit df76cee6bbeb (\u0026quot;mm, page_alloc: remove redundant checks from alloc\nfastpath\u0026quot;).\n\nTo fix it, check NULL pointer for preferred_zoneref-\u0026gt;zone.(CVE-2024-53113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio/vsock: Fix accept_queue memory leak\n\nAs the final stages of socket destruction may be delayed, it is possible\nthat virtio_transport_recv_listen() will be called after the accept_queue\nhas been flushed, but before the SOCK_DONE flag has been set. As a result,\nsockets enqueued after the flush would remain unremoved, leading to a\nmemory leak.\n\nvsock_release\n  __vsock_release\n    lock\n    virtio_transport_release\n      virtio_transport_close\n        schedule_delayed_work(close_work)\n    sk_shutdown = SHUTDOWN_MASK\n(!) flush accept_queue\n    release\n                                        virtio_transport_recv_pkt\n                                          vsock_find_bound_socket\n                                          lock\n                                          if flag(SOCK_DONE) return\n                                          virtio_transport_recv_listen\n                                            child = vsock_create_connected\n                                      (!)   vsock_enqueue_accept(child)\n                                          release\nclose_work\n  lock\n  virtio_transport_do_close\n    set_flag(SOCK_DONE)\n    virtio_transport_remove_sock\n      vsock_remove_sock\n        vsock_remove_bound\n  release\n\nIntroduce a sk_shutdown check to disallow vsock_enqueue_accept() during\nsocket destruction.\n\nunreferenced object 0xffff888109e3f800 (size 2040):\n  comm \u0026quot;kworker/5:2\u0026quot;, pid 371, jiffies 4294940105\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    28 00 0b 40 00 00 00 00 00 00 00 00 00 00 00 00  (..@............\n  backtrace (crc 9e5f4e84):\n    [\u0026lt;ffffffff81418ff1\u0026gt;] kmem_cache_alloc_noprof+0x2c1/0x360\n    [\u0026lt;ffffffff81d27aa0\u0026gt;] sk_prot_alloc+0x30/0x120\n    [\u0026lt;ffffffff81d2b54c\u0026gt;] sk_alloc+0x2c/0x4b0\n    [\u0026lt;ffffffff81fe049a\u0026gt;] __vsock_create.constprop.0+0x2a/0x310\n    [\u0026lt;ffffffff81fe6d6c\u0026gt;] virtio_transport_recv_pkt+0x4dc/0x9a0\n    [\u0026lt;ffffffff81fe745d\u0026gt;] vsock_loopback_work+0xfd/0x140\n    [\u0026lt;ffffffff810fc6ac\u0026gt;] process_one_work+0x20c/0x570\n    [\u0026lt;ffffffff810fce3f\u0026gt;] worker_thread+0x1bf/0x3a0\n    [\u0026lt;ffffffff811070dd\u0026gt;] kthread+0xdd/0x110\n    [\u0026lt;ffffffff81044fdd\u0026gt;] ret_from_fork+0x2d/0x50\n    [\u0026lt;ffffffff8100785a\u0026gt;] ret_from_fork_asm+0x1a/0x30(CVE-2024-53119)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: CT: Fix null-ptr-deref in add rule err flow\n\nIn error flow of mlx5_tc_ct_entry_add_rule(), in case ct_rule_add()\ncallback returns error, zone_rule-\u0026gt;attr is used uninitiated. Fix it to\nuse attr which has the needed pointer value.\n\nKernel log:\n BUG: kernel NULL pointer dereference, address: 0000000000000110\n RIP: 0010:mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core]\n…\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die+0x20/0x70\n  ? page_fault_oops+0x150/0x3e0\n  ? exc_page_fault+0x74/0x140\n  ? asm_exc_page_fault+0x22/0x30\n  ? mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core]\n  ? mlx5_tc_ct_entry_add_rule+0x1d5/0x2f0 [mlx5_core]\n  mlx5_tc_ct_block_flow_offload+0xc6a/0xf90 [mlx5_core]\n  ? nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table]\n  nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table]\n  flow_offload_work_handler+0x142/0x320 [nf_flow_table]\n  ? finish_task_switch.isra.0+0x15b/0x2b0\n  process_one_work+0x16c/0x320\n  worker_thread+0x28c/0x3a0\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0xb8/0xf0\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x2d/0x50\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;(CVE-2024-53120)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, lock FTE when checking if active\n\nThe referenced commits introduced a two-step process for deleting FTEs:\n\n- Lock the FTE, delete it from hardware, set the hardware deletion function\n  to NULL and unlock the FTE.\n- Lock the parent flow group, delete the software copy of the FTE, and\n  remove it from the xarray.\n\nHowever, this approach encounters a race condition if a rule with the same\nmatch value is added simultaneously. In this scenario, fs_core may set the\nhardware deletion function to NULL prematurely, causing a panic during\nsubsequent rule deletions.\n\nTo prevent this, ensure the active flag of the FTE is checked under a lock,\nwhich will prevent the fs_core layer from attaching a new steering rule to\nan FTE that is in the process of deletion.\n\n[  438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func\n[  438.968205] ------------[ cut here ]------------\n[  438.968654] refcount_t: decrement hit 0; leaking memory.\n[  438.969249] WARNING: CPU: 0 PID: 8957 at lib/refcount.c:31 refcount_warn_saturate+0xfb/0x110\n[  438.970054] Modules linked in: act_mirred cls_flower act_gact sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core zram zsmalloc fuse [last unloaded: cls_flower]\n[  438.973288] CPU: 0 UID: 0 PID: 8957 Comm: tc Not tainted 6.12.0-rc1+ #8\n[  438.973888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  438.974874] RIP: 0010:refcount_warn_saturate+0xfb/0x110\n[  438.975363] Code: 40 66 3b 82 c6 05 16 e9 4d 01 01 e8 1f 7c a0 ff 0f 0b c3 cc cc cc cc 48 c7 c7 10 66 3b 82 c6 05 fd e8 4d 01 01 e8 05 7c a0 ff \u0026lt;0f\u0026gt; 0b c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90\n[  438.976947] RSP: 0018:ffff888124a53610 EFLAGS: 00010286\n[  438.977446] RAX: 0000000000000000 RBX: ffff888119d56de0 RCX: 0000000000000000\n[  438.978090] RDX: ffff88852c828700 RSI: ffff88852c81b3c0 RDI: ffff88852c81b3c0\n[  438.978721] RBP: ffff888120fa0e88 R08: 0000000000000000 R09: ffff888124a534b0\n[  438.979353] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888119d56de0\n[  438.979979] R13: ffff888120fa0ec0 R14: ffff888120fa0ee8 R15: ffff888119d56de0\n[  438.980607] FS:  00007fe6dcc0f800(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000\n[  438.983984] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  438.984544] CR2: 00000000004275e0 CR3: 0000000186982001 CR4: 0000000000372eb0\n[  438.985205] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  438.985842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  438.986507] Call Trace:\n[  438.986799]  \u0026lt;TASK\u0026gt;\n[  438.987070]  ? __warn+0x7d/0x110\n[  438.987426]  ? refcount_warn_saturate+0xfb/0x110\n[  438.987877]  ? report_bug+0x17d/0x190\n[  438.988261]  ? prb_read_valid+0x17/0x20\n[  438.988659]  ? handle_bug+0x53/0x90\n[  438.989054]  ? exc_invalid_op+0x14/0x70\n[  438.989458]  ? asm_exc_invalid_op+0x16/0x20\n[  438.989883]  ? refcount_warn_saturate+0xfb/0x110\n[  438.990348]  mlx5_del_flow_rules+0x2f7/0x340 [mlx5_core]\n[  438.990932]  __mlx5_eswitch_del_rule+0x49/0x170 [mlx5_core]\n[  438.991519]  ? mlx5_lag_is_sriov+0x3c/0x50 [mlx5_core]\n[  438.992054]  ? xas_load+0x9/0xb0\n[  438.992407]  mlx5e_tc_rule_unoffload+0x45/0xe0 [mlx5_core]\n[  438.993037]  mlx5e_tc_del_fdb_flow+0x2a6/0x2e0 [mlx5_core]\n[  438.993623]  mlx5e_flow_put+0x29/0x60 [mlx5_core]\n[  438.994161]  mlx5e_delete_flower+0x261/0x390 [mlx5_core]\n[  438.994728]  tc_setup_cb_destroy+0xb9/0x190\n[  438.995150]  fl_hw_destroy_filter+0x94/0xc0 [cls_flower]\n[  438.995650]  fl_change+0x11a4/0x13c0 [cls_flower]\n[  438.996105]  tc_new_tfilter+0x347/0xbc0\n[  438.996503]  ? __\n---truncated---(CVE-2024-53121)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: cope racing subflow creation in mptcp_rcv_space_adjust\n\nAdditional active subflows - i.e. created by the in kernel path\nmanager - are included into the subflow list before starting the\n3whs.\n\nA racing recvmsg() spooling data received on an already established\nsubflow would unconditionally call tcp_cleanup_rbuf() on all the\ncurrent subflows, potentially hitting a divide by zero error on\nthe newly created ones.\n\nExplicitly check that the subflow is in a suitable state before\ninvoking tcp_cleanup_rbuf().(CVE-2024-53122)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: error out earlier on disconnect\n\nEric reported a division by zero splat in the MPTCP protocol:\n\nOops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 UID: 0 PID: 6094 Comm: syz-executor317 Not tainted\n6.12.0-rc5-syzkaller-00291-g05b92660cdfe #0\nHardware name: Google Google Compute Engine/Google Compute Engine,\nBIOS Google 09/13/2024\nRIP: 0010:__tcp_select_window+0x5b4/0x1310 net/ipv4/tcp_output.c:3163\nCode: f6 44 01 e3 89 df e8 9b 75 09 f8 44 39 f3 0f 8d 11 ff ff ff e8\n0d 74 09 f8 45 89 f4 e9 04 ff ff ff e8 00 74 09 f8 44 89 f0 99 \u0026lt;f7\u0026gt; 7c\n24 14 41 29 d6 45 89 f4 e9 ec fe ff ff e8 e8 73 09 f8 48 89\nRSP: 0018:ffffc900041f7930 EFLAGS: 00010293\nRAX: 0000000000017e67 RBX: 0000000000017e67 RCX: ffffffff8983314b\nRDX: 0000000000000000 RSI: ffffffff898331b0 RDI: 0000000000000004\nRBP: 00000000005d6000 R08: 0000000000000004 R09: 0000000000017e67\nR10: 0000000000003e80 R11: 0000000000000000 R12: 0000000000003e80\nR13: ffff888031d9b440 R14: 0000000000017e67 R15: 00000000002eb000\nFS: 00007feb5d7f16c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007feb5d8adbb8 CR3: 0000000074e4c000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u0026lt;TASK\u0026gt;\n__tcp_cleanup_rbuf+0x3e7/0x4b0 net/ipv4/tcp.c:1493\nmptcp_rcv_space_adjust net/mptcp/protocol.c:2085 [inline]\nmptcp_recvmsg+0x2156/0x2600 net/mptcp/protocol.c:2289\ninet_recvmsg+0x469/0x6a0 net/ipv4/af_inet.c:885\nsock_recvmsg_nosec net/socket.c:1051 [inline]\nsock_recvmsg+0x1b2/0x250 net/socket.c:1073\n__sys_recvfrom+0x1a5/0x2e0 net/socket.c:2265\n__do_sys_recvfrom net/socket.c:2283 [inline]\n__se_sys_recvfrom net/socket.c:2279 [inline]\n__x64_sys_recvfrom+0xe0/0x1c0 net/socket.c:2279\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7feb5d857559\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48\n89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d\n01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007feb5d7f1208 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\nRAX: ffffffffffffffda RBX: 00007feb5d8e1318 RCX: 00007feb5d857559\nRDX: 000000800000000e RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007feb5d8e1310 R08: 0000000000000000 R09: ffffffff81000000\nR10: 0000000000000100 R11: 0000000000000246 R12: 00007feb5d8e131c\nR13: 00007feb5d8ae074 R14: 000000800000000e R15: 00000000fffffdef\n\nand provided a nice reproducer.\n\nThe root cause is the current bad handling of racing disconnect.\nAfter the blamed commit below, sk_wait_data() can return (with\nerror) with the underlying socket disconnected and a zero rcv_mss.\n\nCatch the error and return without performing any additional\noperations on the current socket.(CVE-2024-53123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix data-races around sk-\u0026gt;sk_forward_alloc\n\nSyzkaller reported this warning:\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0\n Modules linked in:\n CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:inet_sock_destruct+0x1c5/0x1e0\n Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 \u0026lt;0f\u0026gt; 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00\n RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206\n RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007\n RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00\n RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007\n R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00\n R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78\n FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __warn+0x88/0x130\n  ? inet_sock_destruct+0x1c5/0x1e0\n  ? report_bug+0x18e/0x1a0\n  ? handle_bug+0x53/0x90\n  ? exc_invalid_op+0x18/0x70\n  ? asm_exc_invalid_op+0x1a/0x20\n  ? inet_sock_destruct+0x1c5/0x1e0\n  __sk_destruct+0x2a/0x200\n  rcu_do_batch+0x1aa/0x530\n  ? rcu_do_batch+0x13b/0x530\n  rcu_core+0x159/0x2f0\n  handle_softirqs+0xd3/0x2b0\n  ? __pfx_smpboot_thread_fn+0x10/0x10\n  run_ksoftirqd+0x25/0x30\n  smpboot_thread_fn+0xdd/0x1d0\n  kthread+0xd3/0x100\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x34/0x50\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;\n ---[ end trace 0000000000000000 ]---\n\nIts possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add()\nconcurrently when sk-\u0026gt;sk_state == TCP_LISTEN with sk-\u0026gt;sk_lock unlocked,\nwhich triggers a data-race around sk-\u0026gt;sk_forward_alloc:\ntcp_v6_rcv\n    tcp_v6_do_rcv\n        skb_clone_and_charge_r\n            sk_rmem_schedule\n                __sk_mem_schedule\n                    sk_forward_alloc_add()\n            skb_set_owner_r\n                sk_mem_charge\n                    sk_forward_alloc_add()\n        __kfree_skb\n            skb_release_all\n                skb_release_head_state\n                    sock_rfree\n                        sk_mem_uncharge\n                            sk_forward_alloc_add()\n                            sk_mem_reclaim\n                                // set local var reclaimable\n                                __sk_mem_reclaim\n                                    sk_forward_alloc_add()\n\nIn this syzkaller testcase, two threads call\ntcp_v6_do_rcv() with skb-\u0026gt;truesize=768, the sk_forward_alloc changes like\nthis:\n (cpu 1)             | (cpu 2)             | sk_forward_alloc\n ...                 | ...                 | 0\n __sk_mem_schedule() |                     | +4096 = 4096\n                     | __sk_mem_schedule() | +4096 = 8192\n sk_mem_charge()     |                     | -768  = 7424\n                     | sk_mem_charge()     | -768  = 6656\n ...                 |    ...              |\n sk_mem_uncharge()   |                     | +768  = 7424\n reclaimable=7424    |                     |\n                     | sk_mem_uncharge()   | +768  = 8192\n                     | reclaimable=8192    |\n __sk_mem_reclaim()  |                     | -4096 = 4096\n                     | __sk_mem_reclaim()  | -8192 = -4096 != 0\n\nThe skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when\nsk-\u0026gt;sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock().\nFix the same issue in dccp_v6_do_rcv().(CVE-2024-53124)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN\n\nHide KVM\u0026apos;s pt_mode module param behind CONFIG_BROKEN, i.e. disable support\nfor virtualizing Intel PT via guest/host mode unless BROKEN=y.  There are\nmyriad bugs in the implementation, some of which are fatal to the guest,\nand others which put the stability and health of the host at risk.\n\nFor guest fatalities, the most glaring issue is that KVM fails to ensure\ntracing is disabled, and *stays* disabled prior to VM-Enter, which is\nnecessary as hardware disallows loading (the guest\u0026apos;s) RTIT_CTL if tracing\nis enabled (enforced via a VMX consistency check).  Per the SDM:\n\n  If the logical processor is operating with Intel PT enabled (if\n  IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the \u0026quot;load\n  IA32_RTIT_CTL\u0026quot; VM-entry control must be 0.\n\nOn the host side, KVM doesn\u0026apos;t validate the guest CPUID configuration\nprovided by userspace, and even worse, uses the guest configuration to\ndecide what MSRs to save/load at VM-Enter and VM-Exit.  E.g. configuring\nguest CPUID to enumerate more address ranges than are supported in hardware\nwill result in KVM trying to passthrough, save, and load non-existent MSRs,\nwhich generates a variety of WARNs, ToPA ERRORs in the host, a potential\ndeadlock, etc.(CVE-2024-53135)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\u0026quot;nfs: add support for large folios\u0026quot;)).(CVE-2024-53138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix possible UAF in sctp_v6_available()\n\nA lockdep report [1] with CONFIG_PROVE_RCU_LIST=y hints\nthat sctp_v6_available() is calling dev_get_by_index_rcu()\nand ipv6_chk_addr() without holding rcu.\n\n[1]\n =============================\n WARNING: suspicious RCU usage\n 6.12.0-rc5-virtme #1216 Tainted: G        W\n -----------------------------\n net/core/dev.c:876 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n 1 lock held by sctp_hello/31495:\n #0: ffff9f1ebbdb7418 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_bind (./arch/x86/include/asm/jump_label.h:27 net/sctp/socket.c:315) sctp\n\nstack backtrace:\n CPU: 7 UID: 0 PID: 31495 Comm: sctp_hello Tainted: G        W          6.12.0-rc5-virtme #1216\n Tainted: [W]=WARN\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n dump_stack_lvl (lib/dump_stack.c:123)\n lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)\n dev_get_by_index_rcu (net/core/dev.c:876 (discriminator 7))\n sctp_v6_available (net/sctp/ipv6.c:701) sctp\n sctp_do_bind (net/sctp/socket.c:400 (discriminator 1)) sctp\n sctp_bind (net/sctp/socket.c:320) sctp\n inet6_bind_sk (net/ipv6/af_inet6.c:465)\n ? security_socket_bind (security/security.c:4581 (discriminator 1))\n __sys_bind (net/socket.c:1848 net/socket.c:1869)\n ? do_user_addr_fault (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/linux/mm.h:729 arch/x86/mm/fault.c:1340)\n ? do_user_addr_fault (./arch/x86/include/asm/preempt.h:84 (discriminator 13) ./include/linux/rcupdate.h:98 (discriminator 13) ./include/linux/rcupdate.h:882 (discriminator 13) ./include/linux/mm.h:729 (discriminator 13) arch/x86/mm/fault.c:1340 (discriminator 13))\n __x64_sys_bind (net/socket.c:1877 (discriminator 1) net/socket.c:1875 (discriminator 1) net/socket.c:1875 (discriminator 1))\n do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n RIP: 0033:0x7f59b934a1e7\n Code: 44 00 00 48 8b 15 39 8c 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 31 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 09 8c 0c 00 f7 d8 64 89 01 48\nAll code\n========\n   0:\t44 00 00             \tadd    %r8b,(%rax)\n   3:\t48 8b 15 39 8c 0c 00 \tmov    0xc8c39(%rip),%rdx        # 0xc8c43\n   a:\tf7 d8                \tneg    %eax\n   c:\t64 89 02             \tmov    %eax,%fs:(%rdx)\n   f:\tb8 ff ff ff ff       \tmov    $0xffffffff,%eax\n  14:\teb bd                \tjmp    0xffffffffffffffd3\n  16:\t66 2e 0f 1f 84 00 00 \tcs nopw 0x0(%rax,%rax,1)\n  1d:\t00 00 00\n  20:\t0f 1f 00             \tnopl   (%rax)\n  23:\tb8 31 00 00 00       \tmov    $0x31,%eax\n  28:\t0f 05                \tsyscall\n  2a:*\t48 3d 01 f0 ff ff    \tcmp    $0xfffffffffffff001,%rax\t\t\u0026lt;-- trapping instruction\n  30:\t73 01                \tjae    0x33\n  32:\tc3                   \tret\n  33:\t48 8b 0d 09 8c 0c 00 \tmov    0xc8c09(%rip),%rcx        # 0xc8c43\n  3a:\tf7 d8                \tneg    %eax\n  3c:\t64 89 01             \tmov    %eax,%fs:(%rcx)\n  3f:\t48                   \trex.W\n\nCode starting with the faulting instruction\n===========================================\n   0:\t48 3d 01 f0 ff ff    \tcmp    $0xfffffffffffff001,%rax\n   6:\t73 01                \tjae    0x9\n   8:\tc3                   \tret\n   9:\t48 8b 0d 09 8c 0c 00 \tmov    0xc8c09(%rip),%rcx        # 0xc8c19\n  10:\tf7 d8                \tneg    %eax\n  12:\t64 89 01             \tmov    %eax,%fs:(%rcx)\n  15:\t48                   \trex.W\n RSP: 002b:00007ffe2d0ad398 EFLAGS: 00000202 ORIG_RAX: 0000000000000031\n RAX: ffffffffffffffda RBX: 00007ffe2d0ad3d0 RCX: 00007f59b934a1e7\n RDX: 000000000000001c RSI: 00007ffe2d0ad3d0 RDI: 0000000000000005\n RBP: 0000000000000005 R08: 1999999999999999 R09: 0000000000000000\n R10: 00007f59b9253298 R11: 000000000000\n---truncated---(CVE-2024-53139)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: terminate outstanding dump on socket close\n\nNetlink supports iterative dumping of data. It provides the families\nthe following ops:\n - start - (optional) kicks off the dumping process\n - dump  - actual dump helper, keeps getting called until it returns 0\n - done  - (optional) pairs with .start, can be used for cleanup\nThe whole process is asynchronous and the repeated calls to .dump\ndon\u0026apos;t actually happen in a tight loop, but rather are triggered\nin response to recvmsg() on the socket.\n\nThis gives the user full control over the dump, but also means that\nthe user can close the socket without getting to the end of the dump.\nTo make sure .start is always paired with .done we check if there\nis an ongoing dump before freeing the socket, and if so call .done.\n\nThe complication is that sockets can get freed from BH and .done\nis allowed to sleep. So we use a workqueue to defer the call, when\nneeded.\n\nUnfortunately this does not work correctly. What we defer is not\nthe cleanup but rather releasing a reference on the socket.\nWe have no guarantee that we own the last reference, if someone\nelse holds the socket they may release it in BH and we\u0026apos;re back\nto square one.\n\nThe whole dance, however, appears to be unnecessary. Only the user\ncan interact with dumps, so we can clean up when socket is closed.\nAnd close always happens in process context. Some async code may\nstill access the socket after close, queue notification skbs to it etc.\nbut no dumps can start, end or otherwise make progress.\n\nDelete the workqueue and flush the dump state directly from the release\nhandler. Note that further cleanup is possible in -next, for instance\nwe now always call .done before releasing the main module reference,\nso dump doesn\u0026apos;t have to take a reference of its own.(CVE-2024-53140)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential integer overflow during physmem setup\n\nThis issue happens when the real map size is greater than LONG_MAX,\nwhich can be easily triggered on UML/i386.(CVE-2024-53145)\n\nIn the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipeThis commit addresses a null pointer dereference issue indcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ( drm/amd/display:Add null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipe )partially fixed the null pointer dereference issue. However, indcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, andplane_state is accessed again through pipe_ctx. Multiple if statementsdirectly call attributes of plane_state, leading to potential nullpointer dereference issues. This patch adds necessary null checks toensure stability.(CVE-2024-53201)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix possible deadlocks\n\nThis fixes possible deadlocks like the following caused by\nhci_cmd_sync_dequeue causing the destroy function to run:\n\n INFO: task kworker/u19:0:143 blocked for more than 120 seconds.\n       Tainted: G        W  O        6.8.0-2024-03-19-intel-next-iLS-24ww14 #1\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:kworker/u19:0   state:D stack:0     pid:143   tgid:143   ppid:2      flags:0x00004000\n Workqueue: hci0 hci_cmd_sync_work [bluetooth]\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  __schedule+0x374/0xaf0\n  schedule+0x3c/0xf0\n  schedule_preempt_disabled+0x1c/0x30\n  __mutex_lock.constprop.0+0x3ef/0x7a0\n  __mutex_lock_slowpath+0x13/0x20\n  mutex_lock+0x3c/0x50\n  mgmt_set_connectable_complete+0xa4/0x150 [bluetooth]\n  ? kfree+0x211/0x2a0\n  hci_cmd_sync_dequeue+0xae/0x130 [bluetooth]\n  ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth]\n  cmd_complete_rsp+0x26/0x80 [bluetooth]\n  mgmt_pending_foreach+0x4d/0x70 [bluetooth]\n  __mgmt_power_off+0x8d/0x180 [bluetooth]\n  ? _raw_spin_unlock_irq+0x23/0x40\n  hci_dev_close_sync+0x445/0x5b0 [bluetooth]\n  hci_set_powered_sync+0x149/0x250 [bluetooth]\n  set_powered_sync+0x24/0x60 [bluetooth]\n  hci_cmd_sync_work+0x90/0x150 [bluetooth]\n  process_one_work+0x13e/0x300\n  worker_thread+0x2f7/0x420\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0x107/0x140\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x3d/0x60\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1b/0x30\n  \u0026lt;/TASK\u0026gt;(CVE-2024-53207)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix receive ring space parameters when XDP is active\n\nThe MTU setting at the time an XDP multi-buffer is attached\ndetermines whether the aggregation ring will be used and the\nrx_skb_func handler.  This is done in bnxt_set_rx_skb_mode().\n\nIf the MTU is later changed, the aggregation ring setting may need\nto be changed and it may become out-of-sync with the settings\ninitially done in bnxt_set_rx_skb_mode().  This may result in\nrandom memory corruption and crashes as the HW may DMA data larger\nthan the allocated buffer size, such as:\n\nBUG: kernel NULL pointer dereference, address: 00000000000003c0\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S         OE      6.1.0-226bf9805506 #1\nHardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021\nRIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en]\nCode: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 \u0026lt;0f\u0026gt; b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f\nRSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202\nRAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff\nRDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380\nRBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf\nR10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980\nR13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990\nFS:  0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en]\n\nTo address the issue, we now call bnxt_set_rx_skb_mode() within\nbnxt_change_mtu() to properly set the AGG rings configuration and\nupdate rx_skb_func based on the new MTU value.\nAdditionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of\nbnxt_set_rx_skb_mode() to make sure it gets set or cleared based on\nthe current MTU.(CVE-2024-53209)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs\n\nBase clocks are the first in being probed and are real dependencies of the\nrest of fixed, factor and peripheral clocks. For old ralink SoCs RT2880,\nRT305x and RT3883 \u0026apos;xtal\u0026apos; must be defined first since in any other case,\nwhen fixed clocks are probed they are delayed until \u0026apos;xtal\u0026apos; is probed so the\nfollowing warning appears:\n\n WARNING: CPU: 0 PID: 0 at drivers/clk/ralink/clk-mtmips.c:499 rt3883_bus_recalc_rate+0x98/0x138\n Modules linked in:\n CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.43 #0\n Stack : 805e58d0 00000000 00000004 8004f950 00000000 00000004 00000000 00000000\n 80669c54 80830000 80700000 805ae570 80670068 00000001 80669bf8 00000000\n 00000000 00000000 805ae570 80669b38 00000020 804db7dc 00000000 00000000\n 203a6d6d 80669b78 80669e48 70617773 00000000 805ae570 00000000 00000009\n 00000000 00000001 00000004 00000001 00000000 00000000 83fe43b0 00000000\n ...\n Call Trace:\n [\u0026lt;800065d0\u0026gt;] show_stack+0x64/0xf4\n [\u0026lt;804bca14\u0026gt;] dump_stack_lvl+0x38/0x60\n [\u0026lt;800218ac\u0026gt;] __warn+0x94/0xe4\n [\u0026lt;8002195c\u0026gt;] warn_slowpath_fmt+0x60/0x94\n [\u0026lt;80259ff8\u0026gt;] rt3883_bus_recalc_rate+0x98/0x138\n [\u0026lt;80254530\u0026gt;] __clk_register+0x568/0x688\n [\u0026lt;80254838\u0026gt;] of_clk_hw_register+0x18/0x2c\n [\u0026lt;8070b910\u0026gt;] rt2880_clk_of_clk_init_driver+0x18c/0x594\n [\u0026lt;8070b628\u0026gt;] of_clk_init+0x1c0/0x23c\n [\u0026lt;806fc448\u0026gt;] plat_time_init+0x58/0x18c\n [\u0026lt;806fdaf0\u0026gt;] time_init+0x10/0x6c\n [\u0026lt;806f9bc4\u0026gt;] start_kernel+0x458/0x67c\n\n ---[ end trace 0000000000000000 ]---\n\nWhen this driver was mainlined we could not find any active users of old\nralink SoCs so we cannot perform any real tests for them. Now, one user\nof a Belkin f9k1109 version 1 device which uses RT3883 SoC appeared and\nreported some issues in openWRT:\n- https://github.com/openwrt/openwrt/issues/16054\n\nThus, define a \u0026apos;rt2880_xtal_recalc_rate()\u0026apos; just returning the expected\nfrequency 40Mhz and use it along the old ralink SoCs to have a correct\nboot trace with no warnings and a working clock plan from the beggining.(CVE-2024-53223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix use-after-free in device_for_each_child()\n\nSyzbot has reported the following KASAN splat:\n\nBUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0\nRead of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980\n\nCPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x100/0x190\n ? device_for_each_child+0x18f/0x1a0\n print_report+0x13a/0x4cb\n ? __virt_addr_valid+0x5e/0x590\n ? __phys_addr+0xc6/0x150\n ? device_for_each_child+0x18f/0x1a0\n kasan_report+0xda/0x110\n ? device_for_each_child+0x18f/0x1a0\n ? __pfx_dev_memalloc_noio+0x10/0x10\n device_for_each_child+0x18f/0x1a0\n ? __pfx_device_for_each_child+0x10/0x10\n pm_runtime_set_memalloc_noio+0xf2/0x180\n netdev_unregister_kobject+0x1ed/0x270\n unregister_netdevice_many_notify+0x123c/0x1d80\n ? __mutex_trylock_common+0xde/0x250\n ? __pfx_unregister_netdevice_many_notify+0x10/0x10\n ? trace_contention_end+0xe6/0x140\n ? __mutex_lock+0x4e7/0x8f0\n ? __pfx_lock_acquire.part.0+0x10/0x10\n ? rcu_is_watching+0x12/0xc0\n ? unregister_netdev+0x12/0x30\n unregister_netdevice_queue+0x30d/0x3f0\n ? __pfx_unregister_netdevice_queue+0x10/0x10\n ? __pfx_down_write+0x10/0x10\n unregister_netdev+0x1c/0x30\n bnep_session+0x1fb3/0x2ab0\n ? __pfx_bnep_session+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? __pfx_woken_wake_function+0x10/0x10\n ? __kthread_parkme+0x132/0x200\n ? __pfx_bnep_session+0x10/0x10\n ? kthread+0x13a/0x370\n ? __pfx_bnep_session+0x10/0x10\n kthread+0x2b7/0x370\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x48/0x80\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 4974:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kmalloc_noprof+0x1d1/0x440\n hci_alloc_dev_priv+0x1d/0x2820\n __vhci_create_device+0xef/0x7d0\n vhci_write+0x2c7/0x480\n vfs_write+0x6a0/0xfc0\n ksys_write+0x12f/0x260\n do_syscall_64+0xc7/0x250\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 4979:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x4f/0x70\n kfree+0x141/0x490\n hci_release_dev+0x4d9/0x600\n bt_host_release+0x6a/0xb0\n device_release+0xa4/0x240\n kobject_put+0x1ec/0x5a0\n put_device+0x1f/0x30\n vhci_release+0x81/0xf0\n __fput+0x3f6/0xb30\n task_work_run+0x151/0x250\n do_exit+0xa79/0x2c30\n do_group_exit+0xd5/0x2a0\n get_signal+0x1fcd/0x2210\n arch_do_signal_or_restart+0x93/0x780\n syscall_exit_to_user_mode+0x140/0x290\n do_syscall_64+0xd4/0x250\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nIn \u0026apos;hci_conn_del_sysfs()\u0026apos;, \u0026apos;device_unregister()\u0026apos; may be called when\nan underlying (kobject) reference counter is greater than 1. This\nmeans that reparenting (happened when the device is actually freed)\nis delayed and, during that delay, parent controller device (hciX)\nmay be deleted. Since the latter may create a dangling pointer to\nfreed parent, avoid that scenario by reparenting to NULL explicitly.(CVE-2024-53237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()\n\nMove pm_runtime_set_active() to ivpu_pm_init() so when\nivpu_ipc_send_receive_internal() is executed before ivpu_pm_enable()\nit already has correct runtime state, even if last resume was\nnot successful..(CVE-2024-54193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer\n\nThe AD7923 was updated to support devices with 8 channels, but the size\nof tx_buf and ring_xfer was not increased accordingly, leading to a\npotential buffer overflow in ad7923_update_scan_mode().(CVE-2024-56557)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nad7780: fix division by zero in ad7780_write_raw()\n\nIn the ad7780_write_raw() , val2 can be zero, which might lead to a\ndivision by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw()\nis based on iio_info\u0026apos;s write_raw. While val is explicitly declared that\ncan be zero (in read mode), val2 is not specified to be non-zero.(CVE-2024-56567)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb-\u0026gt;data.(CVE-2024-56590)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix OOB map writes when deleting elements\n\nJordy says:\n\n\u0026quot;\nIn the xsk_map_delete_elem function an unsigned integer\n(map-\u0026gt;max_entries) is compared with a user-controlled signed integer\n(k). Due to implicit type conversion, a large unsigned value for\nmap-\u0026gt;max_entries can bypass the intended bounds check:\n\n\tif (k \u0026gt;= map-\u0026gt;max_entries)\n\t\treturn -EINVAL;\n\nThis allows k to hold a negative value (between -2147483648 and -2),\nwhich is then used as an array index in m-\u0026gt;xsk_map[k], which results\nin an out-of-bounds access.\n\n\tspin_lock_bh(\u0026amp;m-\u0026gt;lock);\n\tmap_entry = \u0026amp;m-\u0026gt;xsk_map[k]; // Out-of-bounds map_entry\n\told_xs = unrcu_pointer(xchg(map_entry, NULL));  // Oob write\n\tif (old_xs)\n\t\txsk_map_sock_delete(old_xs, map_entry);\n\tspin_unlock_bh(\u0026amp;m-\u0026gt;lock);\n\nThe xchg operation can then be used to cause an out-of-bounds write.\nMoreover, the invalid map_entry passed to xsk_map_sock_delete can lead\nto further memory corruption.\n\u0026quot;\n\nIt indeed results in following splat:\n\n[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108\n[76612.904330] #PF: supervisor write access in kernel mode\n[76612.909639] #PF: error_code(0x0002) - not-present page\n[76612.914855] PGD 0 P4D 0\n[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP\n[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470\n[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019\n[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60\n[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff \u0026lt;48\u0026gt; 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31\n[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246\n[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000\n[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000\n[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007\n[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8\n[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0\n[76613.005303] FS:  00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000\n[76613.013517] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0\n[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[76613.041086] PKRU: 55555554\n[76613.043842] Call Trace:\n[76613.046331]  \u0026lt;TASK\u0026gt;\n[76613.048468]  ? __die+0x20/0x60\n[76613.051581]  ? page_fault_oops+0x15a/0x450\n[76613.055747]  ? search_extable+0x22/0x30\n[76613.059649]  ? search_bpf_extables+0x5f/0x80\n[76613.063988]  ? exc_page_fault+0xa9/0x140\n[76613.067975]  ? asm_exc_page_fault+0x22/0x30\n[76613.072229]  ? xsk_map_delete_elem+0x2d/0x60\n[76613.076573]  ? xsk_map_delete_elem+0x23/0x60\n[76613.080914]  __sys_bpf+0x19b7/0x23c0\n[76613.084555]  __x64_sys_bpf+0x1a/0x20\n[76613.088194]  do_syscall_64+0x37/0xb0\n[76613.091832]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[76613.096962] RIP: 0033:0x7f80b6d1e88d\n[76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141\n[76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d\n[76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003\n[76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000\n[76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8\n[76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00\n---truncated---(CVE-2024-56614)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use after free on unload\n\nSystem crash is observed with stack trace warning of use after\nfree. There are 2 signals to tell dpc_thread to terminate (UNLOADING\nflag and kthread_stop).\n\nOn setting the UNLOADING flag when dpc_thread happens to run at the time\nand sees the flag, this causes dpc_thread to exit and clean up\nitself. When kthread_stop is called for final cleanup, this causes use\nafter free.\n\nRemove UNLOADING signal to terminate dpc_thread.  Use the kthread_stop\nas the main signal to exit dpc_thread.\n\n[596663.812935] kernel BUG at mm/slub.c:294!\n[596663.812950] invalid opcode: 0000 [#1] SMP PTI\n[596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-240.el8.x86_64 #1\n[596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012\n[596663.812974] RIP: 0010:__slab_free+0x17d/0x360\n\n...\n[596663.813008] Call Trace:\n[596663.813022]  ? __dentry_kill+0x121/0x170\n[596663.813030]  ? _cond_resched+0x15/0x30\n[596663.813034]  ? _cond_resched+0x15/0x30\n[596663.813039]  ? wait_for_completion+0x35/0x190\n[596663.813048]  ? try_to_wake_up+0x63/0x540\n[596663.813055]  free_task+0x5a/0x60\n[596663.813061]  kthread_stop+0xf3/0x100\n[596663.813103]  qla2x00_remove_one+0x284/0x440 [qla2xxx](CVE-2024-56623)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix LGR and link use-after-free issue\n\nWe encountered a LGR/link use-after-free issue, which manifested as\nthe LGR/link refcnt reaching 0 early and entering the clear process,\nmaking resource access unsafe.\n\n refcount_t: addition on 0; use-after-free.\n WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140\n Workqueue: events smc_lgr_terminate_work [smc]\n Call trace:\n  refcount_warn_saturate+0x9c/0x140\n  __smc_lgr_terminate.part.45+0x2a8/0x370 [smc]\n  smc_lgr_terminate_work+0x28/0x30 [smc]\n  process_one_work+0x1b8/0x420\n  worker_thread+0x158/0x510\n  kthread+0x114/0x118\n\nor\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140\n Workqueue: smc_hs_wq smc_listen_work [smc]\n Call trace:\n  refcount_warn_saturate+0xf0/0x140\n  smcr_link_put+0x1cc/0x1d8 [smc]\n  smc_conn_free+0x110/0x1b0 [smc]\n  smc_conn_abort+0x50/0x60 [smc]\n  smc_listen_find_device+0x75c/0x790 [smc]\n  smc_listen_work+0x368/0x8a0 [smc]\n  process_one_work+0x1b8/0x420\n  worker_thread+0x158/0x510\n  kthread+0x114/0x118\n\nIt is caused by repeated release of LGR/link refcnt. One suspect is that\nsmc_conn_free() is called repeatedly because some smc_conn_free() from\nserver listening path are not protected by sock lock.\n\ne.g.\n\nCalls under socklock        | smc_listen_work\n-------------------------------------------------------\nlock_sock(sk)               | smc_conn_abort\nsmc_conn_free               | \\- smc_conn_free\n\\- smcr_link_put            |    \\- smcr_link_put (duplicated)\nrelease_sock(sk)\n\nSo here add sock lock protection in smc_listen_work() path, making it\nexclusive with other connection operations.(CVE-2024-56640)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: initialize close_work early to avoid warning\n\nWe encountered a warning that close_work was canceled before\ninitialization.\n\n  WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0\n  Workqueue: events smc_lgr_terminate_work [smc]\n  RIP: 0010:__flush_work+0x19e/0x1b0\n  Call Trace:\n   ? __wake_up_common+0x7a/0x190\n   ? work_busy+0x80/0x80\n   __cancel_work_timer+0xe3/0x160\n   smc_close_cancel_work+0x1a/0x70 [smc]\n   smc_close_active_abort+0x207/0x360 [smc]\n   __smc_lgr_terminate.part.38+0xc8/0x180 [smc]\n   process_one_work+0x19e/0x340\n   worker_thread+0x30/0x370\n   ? process_one_work+0x340/0x340\n   kthread+0x117/0x130\n   ? __kthread_cancel_work+0x50/0x50\n   ret_from_fork+0x22/0x30\n\nThis is because when smc_close_cancel_work is triggered, e.g. the RDMA\ndriver is rmmod and the LGR is terminated, the conn-\u0026gt;close_work is\nflushed before initialization, resulting in WARN_ON(!work-\u0026gt;func).\n\n__smc_lgr_terminate             | smc_connect_{rdma|ism}\n-------------------------------------------------------------\n                                | smc_conn_create\n\t\t\t\t| \\- smc_lgr_register_conn\nfor conn in lgr-\u0026gt;conns_all      |\n\\- smc_conn_kill                |\n   \\- smc_close_active_abort    |\n      \\- smc_close_cancel_work  |\n         \\- cancel_work_sync    |\n            \\- __flush_work     |\n\t         (close_work)   |\n\t                        | smc_close_init\n\t                        | \\- INIT_WORK(\u0026amp;close_work)\n\nSo fix this by initializing close_work before establishing the\nconnection.(CVE-2024-56641)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: avoid UAF in btmtk_process_coredump\n\nhci_devcd_append may lead to the release of the skb, so it cannot be\naccessed once it is called.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk]\nRead of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82\n\nCPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G     U             6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c\nHardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024\nWorkqueue: events btusb_rx_work [btusb]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xfd/0x150\n print_report+0x131/0x780\n kasan_report+0x177/0x1c0\n btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01]\n btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\n btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 82:\n stack_trace_save+0xdc/0x190\n kasan_set_track+0x4e/0x80\n __kasan_slab_alloc+0x4e/0x60\n kmem_cache_alloc+0x19f/0x360\n skb_clone+0x132/0xf70\n btusb_recv_acl_mtk+0x104/0x1a0 [btusb]\n btusb_rx_work+0x9e/0xe0 [btusb]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n\nFreed by task 1733:\n stack_trace_save+0xdc/0x190\n kasan_set_track+0x4e/0x80\n kasan_save_free_info+0x28/0xb0\n ____kasan_slab_free+0xfd/0x170\n kmem_cache_free+0x183/0x3f0\n hci_devcd_rx+0x91a/0x2060 [bluetooth]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n\nThe buggy address belongs to the object at ffff888033cfab40\n which belongs to the cache skbuff_head_cache of size 232\nThe buggy address is located 112 bytes inside of\n freed 232-byte region [ffff888033cfab40, ffff888033cfac28)\n\nThe buggy address belongs to the physical page:\npage:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa\nhead:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0x4000000000000840(slab|head|zone=1)\npage_type: 0xffffffff()\nraw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001\nraw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\n ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n\u0026gt;ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                     ^\n ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc\n ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nCheck if we need to call hci_devcd_complete before calling\nhci_devcd_append. That requires that we check data-\u0026gt;cd_info.cnt \u0026gt;=\nMTK_COREDUMP_NUM instead of data-\u0026gt;cd_info.cnt \u0026gt; MTK_COREDUMP_NUM, as we\nincrement data-\u0026gt;cd_info.cnt only once the call to hci_devcd_append\nsucceeds.(CVE-2024-56653)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()\n\nDuring early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,\nsince pageblock_order is still zero and it gets initialized\nlater during initmem_init() e.g.\nsetup_arch() -\u0026gt; initmem_init() -\u0026gt; sparse_init() -\u0026gt; set_pageblock_order()\n\nOne such use case where this causes issue is -\nearly_setup() -\u0026gt; early_init_devtree() -\u0026gt; fadump_reserve_mem() -\u0026gt; fadump_cma_init()\n\nThis causes CMA memory alignment check to be bypassed in\ncma_init_reserved_mem(). Then later cma_activate_area() can hit\na VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; order) - 1)) if the reserved memory\narea was not pageblock_order aligned.\n\nFix it by moving the fadump_cma_init() after initmem_init(),\nwhere other such cma reservations also gets called.\n\n\u0026lt;stack trace\u0026gt;\n==============\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010\nflags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA\nraw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; order) - 1))\n------------[ cut here ]------------\nkernel BUG at mm/page_alloc.c:778!\n\nCall Trace:\n__free_one_page+0x57c/0x7b0 (unreliable)\nfree_pcppages_bulk+0x1a8/0x2c8\nfree_unref_page_commit+0x3d4/0x4e4\nfree_unref_page+0x458/0x6d0\ninit_cma_reserved_pageblock+0x114/0x198\ncma_init_reserved_areas+0x270/0x3e0\ndo_one_initcall+0x80/0x2f8\nkernel_init_freeable+0x33c/0x530\nkernel_init+0x34/0x26c\nret_from_kernel_user_thread+0x14/0x1c(CVE-2024-56677)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: Fix hardware lockup on first Rx endpoint request\n\nThere is a possibility that a request\u0026apos;s callback could be invoked from\nusb_ep_queue() (call trace below, supplemented with missing calls):\n\nreq-\u0026gt;complete from usb_gadget_giveback_request\n\t(drivers/usb/gadget/udc/core.c:999)\nusb_gadget_giveback_request from musb_g_giveback\n\t(drivers/usb/musb/musb_gadget.c:147)\nmusb_g_giveback from rxstate\n\t(drivers/usb/musb/musb_gadget.c:784)\nrxstate from musb_ep_restart\n\t(drivers/usb/musb/musb_gadget.c:1169)\nmusb_ep_restart from musb_ep_restart_resume_work\n\t(drivers/usb/musb/musb_gadget.c:1176)\nmusb_ep_restart_resume_work from musb_queue_resume_work\n\t(drivers/usb/musb/musb_core.c:2279)\nmusb_queue_resume_work from musb_gadget_queue\n\t(drivers/usb/musb/musb_gadget.c:1241)\nmusb_gadget_queue from usb_ep_queue\n\t(drivers/usb/gadget/udc/core.c:300)\n\nAccording to the docstring of usb_ep_queue(), this should not happen:\n\n\u0026quot;Note that @req\u0026apos;s -\u0026gt;complete() callback must never be called from within\nusb_ep_queue() as that can create deadlock situations.\u0026quot;\n\nIn fact, a hardware lockup might occur in the following sequence:\n\n1. The gadget is initialized using musb_gadget_enable().\n2. Meanwhile, a packet arrives, and the RXPKTRDY flag is set, raising an\n   interrupt.\n3. If IRQs are enabled, the interrupt is handled, but musb_g_rx() finds an\n   empty queue (next_request() returns NULL). The interrupt flag has\n   already been cleared by the glue layer handler, but the RXPKTRDY flag\n   remains set.\n4. The first request is enqueued using usb_ep_queue(), leading to the call\n   of req-\u0026gt;complete(), as shown in the call trace above.\n5. If the callback enables IRQs and another packet is waiting, step (3)\n   repeats. The request queue is empty because usb_g_giveback() removes the\n   request before invoking the callback.\n6. The endpoint remains locked up, as the interrupt triggered by hardware\n   setting the RXPKTRDY flag has been handled, but the flag itself remains\n   set.\n\nFor this scenario to occur, it is only necessary for IRQs to be enabled at\nsome point during the complete callback. This happens with the USB Ethernet\ngadget, whose rx_complete() callback calls netif_rx(). If called in the\ntask context, netif_rx() disables the bottom halves (BHs). When the BHs are\nre-enabled, IRQs are also enabled to allow soft IRQs to be processed. The\ngadget itself is initialized at module load (or at boot if built-in), but\nthe first request is enqueued when the network interface is brought up,\ntriggering rx_complete() in the task context via ioctl(). If a packet\narrives while the interface is down, it can prevent the interface from\nreceiving any further packets from the USB host.\n\nThe situation is quite complicated with many parties involved. This\nparticular issue can be resolved in several possible ways:\n\n1. Ensure that callbacks never enable IRQs. This would be difficult to\n   enforce, as discovering how netif_rx() interacts with interrupts was\n   already quite challenging and u_ether is not the only function driver.\n   Similar \u0026quot;bugs\u0026quot; could be hidden in other drivers as well.\n2. Disable MUSB interrupts in musb_g_giveback() before calling the callback\n   and re-enable them afterwars (by calling musb_{dis,en}able_interrupts(),\n   for example). This would ensure that MUSB interrupts are not handled\n   during the callback, even if IRQs are enabled. In fact, it would allow\n   IRQs to be enabled when releasing the lock. However, this feels like an\n   inelegant hack.\n3. Modify the interrupt handler to clear the RXPKTRDY flag if the request\n   queue is empty. While this approach also feels like a hack, it wastes\n   CPU time by attempting to handle incoming packets when the software is\n   not ready to process them.\n4. Flush the Rx FIFO instead of calling rxstate() in musb_ep_restart().\n   This ensures that the hardware can receive packets when there is at\n   least one request in the queue. Once I\n---truncated---(CVE-2024-56687)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport\n\nSince transport-\u0026gt;sock has been set to NULL during reset transport,\nXPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the\nxs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request()\nto dereference the transport-\u0026gt;sock that has been set to NULL.(CVE-2024-56688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Fix dtl_access_lock to be a rw_semaphore\n\nThe dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because\nthe code calls kmalloc() while holding it, which can sleep:\n\n  # echo 1 \u0026gt; /proc/powerpc/vcpudispatch_stats\n  BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh\n  preempt_count: 1, expected: 0\n  3 locks held by sh/199:\n   #0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x324/0x438\n   #1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at: vcpudispatch_stats_write+0xd4/0x5f4\n   #2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at: vcpudispatch_stats_write+0x220/0x5f4\n  CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152\n  Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries\n  Call Trace:\n    dump_stack_lvl+0x130/0x148 (unreliable)\n    __might_resched+0x174/0x410\n    kmem_cache_alloc_noprof+0x340/0x3d0\n    alloc_dtl_buffers+0x124/0x1ac\n    vcpudispatch_stats_write+0x2a8/0x5f4\n    proc_reg_write+0xf4/0x150\n    vfs_write+0xfc/0x438\n    ksys_write+0x88/0x148\n    system_call_exception+0x1c4/0x5a0\n    system_call_common+0xf4/0x258(CVE-2024-56701)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: protect link down work from execute after lgr freed\n\nlink down work may be scheduled before lgr freed but execute\nafter lgr freed, which may result in crash. So it is need to\nhold a reference before shedule link down work, and put the\nreference after work executed or canceled.\n\nThe relevant crash call stack as follows:\n list_del corruption. prev-\u0026gt;next should be ffffb638c9c0fe20,\n    but was 0000000000000000\n ------------[ cut here ]------------\n kernel BUG at lib/list_debug.c:51!\n invalid opcode: 0000 [#1] SMP NOPTI\n CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1\n Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014\n Workqueue: events smc_link_down_work [smc]\n RIP: 0010:__list_del_entry_valid.cold+0x31/0x47\n RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086\n RAX: 0000000000000054 RBX: ffff942fb75e5128 RCX: 0000000000000000\n RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80\n RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb638c9c0fc38\n R10: ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: 0000000000000002\n R13: ffffb638c9c0fe20 R14: 0000000000000001 R15: ffff942f9cd051c0\n FS:  0000000000000000(0000) GS:ffff943520900000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  rwsem_down_write_slowpath+0x17e/0x470\n  smc_link_down_work+0x3c/0x60 [smc]\n  process_one_work+0x1ac/0x350\n  worker_thread+0x49/0x2f0\n  ? rescuer_thread+0x360/0x360\n  kthread+0x118/0x140\n  ? __kthread_bind_mask+0x60/0x60\n  ret_from_fork+0x1f/0x30(CVE-2024-56718)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Initialize cfid-\u0026gt;tcon before performing network ops\n\nAvoid leaking a tcon ref when a lease break races with opening the\ncached directory. Processing the leak break might take a reference to\nthe tcon in cached_dir_lease_break() and then fail to release the ref in\ncached_dir_offload_close, since cfid-\u0026gt;tcon is still NULL.(CVE-2024-56729)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: check folio mapping after unlock in relocate_one_folio()\n\nWhen we call btrfs_read_folio() to bring a folio uptodate, we unlock the\nfolio. The result of that is that a different thread can modify the\nmapping (like remove it with invalidate) before we call folio_lock().\nThis results in an invalid page and we need to try again.\n\nIn particular, if we are relocating concurrently with aborting a\ntransaction, this can result in a crash like the following:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  PGD 0 P4D 0\n  Oops: 0000 [#1] SMP\n  CPU: 76 PID: 1411631 Comm: kworker/u322:5\n  Workqueue: events_unbound btrfs_reclaim_bgs_work\n  RIP: 0010:set_page_extent_mapped+0x20/0xb0\n  RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246\n  RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880\n  RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0\n  R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000\n  R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff\n  FS:  0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die+0x78/0xc0\n  ? page_fault_oops+0x2a8/0x3a0\n  ? __switch_to+0x133/0x530\n  ? wq_worker_running+0xa/0x40\n  ? exc_page_fault+0x63/0x130\n  ? asm_exc_page_fault+0x22/0x30\n  ? set_page_extent_mapped+0x20/0xb0\n  relocate_file_extent_cluster+0x1a7/0x940\n  relocate_data_extent+0xaf/0x120\n  relocate_block_group+0x20f/0x480\n  btrfs_relocate_block_group+0x152/0x320\n  btrfs_relocate_chunk+0x3d/0x120\n  btrfs_reclaim_bgs_work+0x2ae/0x4e0\n  process_scheduled_works+0x184/0x370\n  worker_thread+0xc6/0x3e0\n  ? blk_add_timer+0xb0/0xb0\n  kthread+0xae/0xe0\n  ? flush_tlb_kernel_range+0x90/0x90\n  ret_from_fork+0x2f/0x40\n  ? flush_tlb_kernel_range+0x90/0x90\n  ret_from_fork_asm+0x11/0x20\n  \u0026lt;/TASK\u0026gt;\n\nThis occurs because cleanup_one_transaction() calls\ndestroy_delalloc_inodes() which calls invalidate_inode_pages2() which\ntakes the folio_lock before setting mapping to NULL. We fail to check\nthis, and subsequently call set_extent_mapping(), which assumes that\nmapping != NULL (in fact it asserts that in debug mode)\n\nNote that the \u0026quot;fixes\u0026quot; patch here is not the one that introduced the\nrace (the very first iteration of this code from 2009) but a more recent\nchange that made this particular crash happen in practice..(CVE-2024-56758)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg\n\nSyzbot reports [1] an uninitialized value issue found by KMSAN in\ndib3000_read_reg().\n\nLocal u8 rb[2] is used in i2c_transfer() as a read buffer; in case\nthat call fails, the buffer may end up with some undefined values.\n\nSince no elaborate error handling is expected in dib3000_write_reg(),\nsimply zero out rb buffer to mitigate the problem.\n\n[1] Syzkaller report\ndvb-usb: bulk message failed: -22 (6/0)\n=====================================================\nBUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31\n dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290\n dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]\n dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]\n dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310\n dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110\n...\nLocal variable rb created at:\n dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54\n dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n...(CVE-2024-56769)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur\n\nThe action force umount(umount -f) will attempt to kill all rpc_task even\numount operation may ultimately fail if some files remain open.\nConsequently, if an action attempts to open a file, it can potentially\nsend two rpc_task to nfs server.\n\n                   NFS CLIENT\nthread1                             thread2\nopen(\u0026quot;file\u0026quot;)\n...\nnfs4_do_open\n _nfs4_do_open\n  _nfs4_open_and_get_state\n   _nfs4_proc_open\n    nfs4_run_open_task\n     /* rpc_task1 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\n                                    umount -f\n                                    nfs_umount_begin\n                                     rpc_killall_tasks\n                                      rpc_signal_task\n     rpc_task1 been wakeup\n     and return -512\n _nfs4_do_open // while loop\n    ...\n    nfs4_run_open_task\n     /* rpc_task2 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\nWhile processing an open request, nfsd will first attempt to find or\nallocate an nfs4_openowner. If it finds an nfs4_openowner that is not\nmarked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since\ntwo rpc_task can attempt to open the same file simultaneously from the\nclient to server, and because two instances of nfsd can run\nconcurrently, this situation can lead to lots of memory leak.\nAdditionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be\ntriggered.\n\n                    NFS SERVER\nnfsd1                  nfsd2       echo 0 \u0026gt; /proc/fs/nfsd/threads\n\nnfsd4_open\n nfsd4_process_open1\n  find_or_alloc_open_stateowner\n   // alloc oo1, stateid1\n                       nfsd4_open\n                        nfsd4_process_open1\n                        find_or_alloc_open_stateowner\n                        // find oo1, without NFS4_OO_CONFIRMED\n                         release_openowner\n                          unhash_openowner_locked\n                          list_del_init(\u0026amp;oo-\u0026gt;oo_perclient)\n                          // cannot find this oo\n                          // from client, LEAK!!!\n                         alloc_stateowner // alloc oo2\n\n nfsd4_process_open2\n  init_open_stateid\n  // associate oo1\n  // with stateid1, stateid1 LEAK!!!\n  nfs4_get_vfs_file\n  // alloc nfsd_file1 and nfsd_file_mark1\n  // all LEAK!!!\n\n                         nfsd4_process_open2\n                         ...\n\n                                    write_threads\n                                     ...\n                                     nfsd_destroy_serv\n                                      nfsd_shutdown_net\n                                       nfs4_state_shutdown_net\n                                        nfs4_state_destroy_net\n                                         destroy_client\n                                          __destroy_client\n                                          // won\u0026apos;t find oo1!!!\n                                     nfsd_shutdown_generic\n                                      nfsd_file_cache_shutdown\n                                       kmem_cache_destroy\n                                       for nfsd_file_slab\n                                       and nfsd_file_mark_slab\n                                       // bark since nfsd_file1\n                                       // and nfsd_file_mark1\n                                       // still alive\n\n=======================================================================\nBUG nfsd_file (Not tainted): Objects remaining in nfsd_file on\n__kmem_cache_shutdown()\n-----------------------------------------------------------------------\n\nSlab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28\nflags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)\nCPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dum\n---truncated---(CVE-2024-56779)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: imx6: Fix suspend/resume support on i.MX6QDL\n\nThe suspend/resume functionality is currently broken on the i.MX6QDL\nplatform, as documented in the NXP errata (ERR005723):\n\n  https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf\n\nThis patch addresses the issue by sharing most of the suspend/resume\nsequences used by other i.MX devices, while avoiding modifications to\ncritical registers that disrupt the PCIe functionality. It targets the\nsame problem as the following downstream commit:\n\n  https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995\n\nUnlike the downstream commit, this patch also resets the connected PCIe\ndevice if possible. Without this reset, certain drivers, such as ath10k\nor iwlwifi, will crash on resume. The device reset is also done by the\ndriver on other i.MX platforms, making this patch consistent with\nexisting practices.\n\nUpon resuming, the kernel will hang and display an error. Here\u0026apos;s an\nexample of the error encountered with the ath10k driver:\n\n  ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible\n  Unhandled fault: imprecise external abort (0x1406) at 0x0106f944\n\nWithout this patch, suspend/resume will fail on i.MX6QDL devices if a\nPCIe device is connected.\n\n[kwilczynski: commit log, added tag for stable releases](CVE-2024-57809)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL\n\nCurrently tagged_addr_ctrl_set() doesn\u0026apos;t initialize the temporary \u0026apos;ctrl\u0026apos;\nvariable, and a SETREGSET call with a length of zero will leave this\nuninitialized. Consequently tagged_addr_ctrl_set() will consume an\narbitrary value, potentially leaking up to 64 bits of memory from the\nkernel stack. The read is limited to a specific slot on the stack, and\nthe issue does not provide a write mechanism.\n\nAs set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and\nrejects other values, a partial SETREGSET attempt will randomly succeed\nor fail depending on the value of the uninitialized value, and the\nexposure is significantly limited.\n\nFix this by initializing the temporary value before copying the regset\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\nvalue of the tagged address ctrl will be retained.\n\nThe NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the\nuser_aarch64_view used by a native AArch64 task to manipulate another\nnative AArch64 task. As get_tagged_addr_ctrl() only returns an error\nvalue when called for a compat task, tagged_addr_ctrl_get() and\ntagged_addr_ctrl_set() should never observe an error value from\nget_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that\nsuch an error would be unexpected, and error handlnig is not missing in\neither case.(CVE-2024-57874)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\n\nWhen mounting ocfs2 and then remounting it as read-only, a\nslab-use-after-free occurs after the user uses a syscall to\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u0026gt;dqi_priv is the\ndangling pointer.\n\nDuring the remounting process, the pointer dqi_priv is freed but is never\nset as null leaving it to be accessed.  Additionally, the read-only option\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\nnext quota, the function ocfs2_get_next_id is called and only checks the\nquota usage flags and not the quota suspended flags.\n\nTo fix this, I set dqi_priv to null when it is freed after remounting with\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\n\n[akpm@linux-foundation.org: coding-style cleanups](CVE-2024-57892)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ti-ads8688: fix information leak in triggered buffer\n\nThe \u0026apos;buffer\u0026apos; local array is used to push data to user space from a\ntriggered buffer, but it does not set values for inactive channels, as\nit only uses iio_for_each_active_channel() to assign new values.\n\nInitialize the array to zero before using it to avoid pushing\nuninitialized information to userspace.(CVE-2024-57906)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: light: vcnl4035: fix information leak in triggered buffer\n\nThe \u0026apos;buffer\u0026apos; local array is used to push data to userspace from a\ntriggered buffer, but it does not set an initial value for the single\ndata element, which is an u16 aligned to 8 bytes. That leaves at least\n4 bytes uninitialized even after writing an integer value with\nregmap_read().\n\nInitialize the array to zero before using it to avoid pushing\nuninitialized information to userspace.(CVE-2024-57910)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntopology: Keep the cpumask unchanged when printing cpumap\n\nDuring fuzz testing, the following warning was discovered:\n\n different return values (15 and 11) from vsnprintf(\u0026quot;%*pbl\n \u0026quot;, ...)\n\n test:keyward is WARNING in kvasprintf\n WARNING: CPU: 55 PID: 1168477 at lib/kasprintf.c:30 kvasprintf+0x121/0x130\n Call Trace:\n  kvasprintf+0x121/0x130\n  kasprintf+0xa6/0xe0\n  bitmap_print_to_buf+0x89/0x100\n  core_siblings_list_read+0x7e/0xb0\n  kernfs_file_read_iter+0x15b/0x270\n  new_sync_read+0x153/0x260\n  vfs_read+0x215/0x290\n  ksys_read+0xb9/0x160\n  do_syscall_64+0x56/0x100\n  entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe call trace shows that kvasprintf() reported this warning during the\nprinting of core_siblings_list. kvasprintf() has several steps:\n\n (1) First, calculate the length of the resulting formatted string.\n\n (2) Allocate a buffer based on the returned length.\n\n (3) Then, perform the actual string formatting.\n\n (4) Check whether the lengths of the formatted strings returned in\n     steps (1) and (2) are consistent.\n\nIf the core_cpumask is modified between steps (1) and (3), the lengths\nobtained in these two steps may not match. Indeed our test includes cpu\nhotplugging, which should modify core_cpumask while printing.\n\nTo fix this issue, cache the cpumask into a temporary variable before\ncalling cpumap_print_{list, cpumask}_to_buf(), to keep it unchanged\nduring the printing process.(CVE-2024-57917)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add check for granularity in dml ceil/floor helpers\n\n[Why]\nWrapper functions for dcn_bw_ceil2() and dcn_bw_floor2()\nshould check for granularity is non zero to avoid assert and\ndivide-by-zero error in dcn_bw_ functions.\n\n[How]\nAdd check for granularity 0.\n\n(cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec)(CVE-2024-57922)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Set private-\u0026gt;all_drm_private[i]-\u0026gt;drm to NULL if mtk_drm_bind returns err\n\nThe pointer need to be set to NULL, otherwise KASAN complains about\nuse-after-free. Because in mtk_drm_bind, all private\u0026apos;s drm are set\nas follows.\n\nprivate-\u0026gt;all_drm_private[i]-\u0026gt;drm = drm;\n\nAnd drm will be released by drm_dev_put in case mtk_drm_kms_init returns\nfailure. However, the shutdown path still accesses the previous allocated\nmemory in drm_atomic_helper_shutdown.\n\n[   84.874820] watchdog: watchdog0: watchdog did not stop!\n[   86.512054] ==================================================================\n[   86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378\n[   86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1\n[   86.515213]\n[   86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55\n[   86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022\n[   86.517960] Call trace:\n[   86.518333]  show_stack+0x20/0x38 (C)\n[   86.518891]  dump_stack_lvl+0x90/0xd0\n[   86.519443]  print_report+0xf8/0x5b0\n[   86.519985]  kasan_report+0xb4/0x100\n[   86.520526]  __asan_report_load8_noabort+0x20/0x30\n[   86.521240]  drm_atomic_helper_shutdown+0x33c/0x378\n[   86.521966]  mtk_drm_shutdown+0x54/0x80\n[   86.522546]  platform_shutdown+0x64/0x90\n[   86.523137]  device_shutdown+0x260/0x5b8\n[   86.523728]  kernel_restart+0x78/0xf0\n[   86.524282]  __do_sys_reboot+0x258/0x2f0\n[   86.524871]  __arm64_sys_reboot+0x90/0xd8\n[   86.525473]  invoke_syscall+0x74/0x268\n[   86.526041]  el0_svc_common.constprop.0+0xb0/0x240\n[   86.526751]  do_el0_svc+0x4c/0x70\n[   86.527251]  el0_svc+0x4c/0xc0\n[   86.527719]  el0t_64_sync_handler+0x144/0x168\n[   86.528367]  el0t_64_sync+0x198/0x1a0\n[   86.528920]\n[   86.529157] The buggy address belongs to the physical page:\n[   86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc\n[   86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff)\n[   86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000\n[   86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000\n[   86.534511] page dumped because: kasan: bad access detected\n[   86.535323]\n[   86.535559] Memory state around the buggy address:\n[   86.536265]  ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.537314]  ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.538363] \u0026gt;ffff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.544733]                                                           ^\n[   86.551057]  ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.557510]  ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.563928] ==================================================================\n[   86.571093] Disabling lock debugging due to kernel taint\n[   86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b\n[   86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f]\n...(CVE-2024-57926)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure shadow stack is active before \u0026quot;getting\u0026quot; registers\n\nThe x86 shadow stack support has its own set of registers. Those registers\nare XSAVE-managed, but they are \u0026quot;supervisor state components\u0026quot; which means\nthat userspace can not touch them with XSAVE/XRSTOR.  It also means that\nthey are not accessible from the existing ptrace ABI for XSAVE state.\nThus, there is a new ptrace get/set interface for it.\n\nThe regset code that ptrace uses provides an -\u0026gt;active() handler in\naddition to the get/set ones. For shadow stack this -\u0026gt;active() handler\nverifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the\nthread struct. The -\u0026gt;active() handler is checked from some call sites of\nthe regset get/set handlers, but not the ptrace ones. This was not\nunderstood when shadow stack support was put in place.\n\nAs a result, both the set/get handlers can be called with\nXFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to\nreturn NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an\nssp_active() check to avoid surprising the kernel with shadow stack\nbehavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That\ncheck just happened to avoid the warning.\n\nBut the -\u0026gt;get() side wasn\u0026apos;t so lucky. It can be called with shadow stacks\ndisabled, triggering the warning in practice, as reported by Christina\nSchimpe:\n\nWARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0\n[...]\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_regs+0x6e/0x80\n? ssp_get+0x89/0xa0\n? __warn+0x91/0x150\n? ssp_get+0x89/0xa0\n? report_bug+0x19d/0x1b0\n? handle_bug+0x46/0x80\n? exc_invalid_op+0x1d/0x80\n? asm_exc_invalid_op+0x1f/0x30\n? __pfx_ssp_get+0x10/0x10\n? ssp_get+0x89/0xa0\n? ssp_get+0x52/0xa0\n__regset_get+0xad/0xf0\ncopy_regset_to_user+0x52/0xc0\nptrace_regset+0x119/0x140\nptrace_request+0x13c/0x850\n? wait_task_inactive+0x142/0x1d0\n? do_syscall_64+0x6d/0x90\narch_ptrace+0x102/0x300\n[...]\n\nEnsure that shadow stacks are active in a thread before looking them up\nin the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are\nset at the same time, the active check ensures that there will be\nsomething to find in the XSAVE buffer.\n\n[ dhansen: changelog/subject tweaks ](CVE-2025-21632)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: avoid NULL pointer dereference if no valid extent tree\n\n[BUG]\nSyzbot reported a crash with the following call trace:\n\n  BTRFS info (device loop0): scrub: started on devid 1\n  BUG: kernel NULL pointer dereference, address: 0000000000000208\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0\n  Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206\n  Tainted: [O]=OOT_MODULE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]\n   scrub_simple_mirror+0x175/0x260 [btrfs]\n   scrub_stripe+0x5d4/0x6c0 [btrfs]\n   scrub_chunk+0xbb/0x170 [btrfs]\n   scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]\n   btrfs_scrub_dev+0x240/0x600 [btrfs]\n   btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]\n   ? do_sys_openat2+0xa5/0xf0\n   __x64_sys_ioctl+0x97/0xc0\n   do_syscall_64+0x4f/0x120\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\n[CAUSE]\nThe reproducer is using a corrupted image where extent tree root is\ncorrupted, thus forcing to use \u0026quot;rescue=all,ro\u0026quot; mount option to mount the\nimage.\n\nThen it triggered a scrub, but since scrub relies on extent tree to find\nwhere the data/metadata extents are, scrub_find_fill_first_stripe()\nrelies on an non-empty extent root.\n\nBut unfortunately scrub_find_fill_first_stripe() doesn\u0026apos;t really expect\nan NULL pointer for extent root, it use extent_root to grab fs_info and\ntriggered a NULL pointer dereference.\n\n[FIX]\nAdd an extra check for a valid extent root at the beginning of\nscrub_find_fill_first_stripe().\n\nThe new error path is introduced by 42437a6386ff (\u0026quot;btrfs: introduce\nmount option rescue=ignorebadroots\u0026quot;), but that\u0026apos;s pretty old, and later\ncommit b979547513ff (\u0026quot;btrfs: scrub: introduce helper to find and fill\nsector info for a scrub_stripe\u0026quot;) changed how we do scrub.\n\nSo for kernels older than 6.6, the fix will need manual backport.(CVE-2025-21658)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/bpf: return early if transport is not assigned\n\nSome of the core functions can only be called if the transport\nhas been assigned.\n\nAs Michal reported, a socket might have the transport at NULL,\nfor example after a failed connect(), causing the following trace:\n\n    BUG: kernel NULL pointer dereference, address: 00000000000000a0\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0\n    Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n    CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+\n    RIP: 0010:vsock_connectible_has_data+0x1f/0x40\n    Call Trace:\n     vsock_bpf_recvmsg+0xca/0x5e0\n     sock_recvmsg+0xb9/0xc0\n     __sys_recvfrom+0xb3/0x130\n     __x64_sys_recvfrom+0x20/0x30\n     do_syscall_64+0x93/0x180\n     entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nSo we need to check the `vsk-\u0026gt;transport` in vsock_bpf_recvmsg(),\nespecially for connected sockets (stream/seqpacket) as we already\ndo in __vsock_connectible_recvmsg().(CVE-2025-21670)","status":"published","published":"2025-02-08T11:08:11Z","modified":"2026-08-18T01:18:46.697958941Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1095","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix race condition between session lookup and expire\n\n Thread A                        +  Thread B\n ksmbd_session_lookup            |  smb2_sess_setup\n   sess = xa_load                |\n                                 |\n                                 |    xa_erase(\u0026amp;conn-\u0026gt;sessions, sess-\u0026gt;id);\n                                 |\n                                 |    ksmbd_session_destroy(sess) --\u0026gt; kfree(sess)\n                                 |\n   // UAF!                       |\n   sess-\u0026gt;last_active = jiffies   |\n                                 +\n\nThis patch add rwsem to fix race condition between ksmbd_session_lookup\nand ksmbd_expire_session.(CVE-2023-52480)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix connection failure handling\n\nIn case immediate MPA request processing fails, the newly\ncreated endpoint unlinks the listening endpoint and is\nready to be dropped. This special case was not handled\ncorrectly by the code handling the later TCP socket close,\ncausing a NULL dereference crash in siw_cm_work_handler()\nwhen dereferencing a NULL listener. We now also cancel\nthe useless MPA timeout, if immediate MPA request\nprocessing fails.\n\nThis patch furthermore simplifies MPA processing in general:\nScheduling a useless TCP socket read in sk_data_ready() upcall\nis now surpressed, if the socket is already moved out of\nTCP_ESTABLISHED state.(CVE-2023-52513)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Fix buffer overflow in trans_stat_show\n\nFix buffer overflow in trans_stat_show().\n\nConvert simple snprintf to the more secure scnprintf with size of\nPAGE_SIZE.\n\nAdd condition checking if we are exceeding PAGE_SIZE and exit early from\nloop. Also add at the end a warning that we exceeded PAGE_SIZE and that\nstats is disabled.\n\nReturn -EFBIG in the case where we don\u0026apos;t have enough space to write the\nfull transition table.\n\nAlso document in the ABI that this function can return -EFBIG error.(CVE-2023-52614)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7091r: Allow users to configure device events\n\nAD7091R-5 devices are supported by the ad7091r-5 driver together with\nthe ad7091r-base driver. Those drivers declared iio events for notifying\nuser space when ADC readings fall bellow the thresholds of low limit\nregisters or above the values set in high limit registers.\nHowever, to configure iio events and their thresholds, a set of callback\nfunctions must be implemented and those were not present until now.\nThe consequence of trying to configure ad7091r-5 events without the\nproper callback functions was a null pointer dereference in the kernel\nbecause the pointers to the callback functions were not set.\n\nImplement event configuration callbacks allowing users to read/write\nevent thresholds and enable/disable event generation.\n\nSince the event spec structs are generic to AD7091R devices, also move\nthose from the ad7091r-5 driver the base driver so they can be reused\nwhen support for ad7091r-2/-4/-8 be added.(CVE-2023-52627)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential context UAFs\n\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this.  And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)(CVE-2023-52913)\n\nA race condition was found in the Linux kernel\u0026apos;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.\n\n\n\n\n(CVE-2024-24857)\n\nA race condition was found in the Linux kernel\u0026apos;s net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.\n\n\n\n\n\n\n\n(CVE-2024-24859)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxhci: handle isoc Babble and Buffer Overrun events properly\n\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\nownership of a multi-TRB TD when it reports an error on one of the\nearly TRBs. Yet the driver makes such assumption and releases the TD,\nallowing the remaining TRBs to be freed or overwritten by new TDs.\n\nThe xHC should also report completion of the final TRB due to its IOC\nflag being set by us, regardless of prior errors. This event cannot\nbe recognized if the TD has already been freed earlier, resulting in\n\u0026quot;Transfer event TRB DMA ptr not part of current TD\u0026quot; error message.\n\nFix this by reusing the logic for processing isoc Transaction Errors.\nThis also handles hosts which fail to report the final completion.\n\nFix transfer length reporting on Babble errors. They may be caused by\ndevice malfunction, no guarantee that the buffer has been filled.(CVE-2024-26659)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) Fix out-of-bounds memory access\n\nFix a bug that pdata-\u0026gt;cpu_map[] is set before out-of-bounds check.\nThe problem might be triggered on systems with more than 128 cores per\npackage.(CVE-2024-26664)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations\n\n- Disallow families other than NFPROTO_{IPV4,IPV6,INET}.\n- Disallow layer 4 protocol with no ports, since destination port is a\n  mandatory attribute for this object.(CVE-2024-26673)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: roles: fix NULL pointer issue when put module\u0026apos;s reference\n\nIn current design, usb role class driver will get usb_role_switch parent\u0026apos;s\nmodule reference after the user get usb_role_switch device and put the\nreference after the user put the usb_role_switch device. However, the\nparent device of usb_role_switch may be removed before the user put the\nusb_role_switch. If so, then, NULL pointer issue will be met when the user\nput the parent module\u0026apos;s reference.\n\nThis will save the module pointer in structure of usb_role_switch. Then,\nwe don\u0026apos;t need to find module by iterating long relations.(CVE-2024-26747)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix memory double free when handle zero packet\n\n829  if (request-\u0026gt;complete) {\n830          spin_unlock(\u0026amp;priv_dev-\u0026gt;lock);\n831          usb_gadget_giveback_request(\u0026amp;priv_ep-\u0026gt;endpoint,\n832                                    request);\n833          spin_lock(\u0026amp;priv_dev-\u0026gt;lock);\n834  }\n835\n836  if (request-\u0026gt;buf == priv_dev-\u0026gt;zlp_buf)\n837      cdns3_gadget_ep_free_request(\u0026amp;priv_ep-\u0026gt;endpoint, request);\n\nDriver append an additional zero packet request when queue a packet, which\nlength mod max packet size is 0. When transfer complete, run to line 831,\nusb_gadget_giveback_request() will free this requestion. 836 condition is\ntrue, so cdns3_gadget_ep_free_request() free this request again.\n\nLog:\n\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.140696][  T150]\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\n\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\nadditional zero length packet request. Needn\u0026apos;t call\nusb_gadget_giveback_request() because it is allocated in this driver.(CVE-2024-26748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()\n\n  ...\n  cdns3_gadget_ep_free_request(\u0026amp;priv_ep-\u0026gt;endpoint, \u0026amp;priv_req-\u0026gt;request);\n  list_del_init(\u0026amp;priv_req-\u0026gt;list);\n  ...\n\n\u0026apos;priv_req\u0026apos; actually free at cdns3_gadget_ep_free_request(). But\nlist_del_init() use priv_req-\u0026gt;list after it.\n\n[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4\n[ 1542.642868][  T534]\n[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):\n[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4\n[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]\n[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4\n[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8\n[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368\n[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28\n\nMove list_del_init() before cdns3_gadget_ep_free_request() to resolve this\nproblem.(CVE-2024-26749)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: virtio/akcipher - Fix stack overflow on memcpy\n\nsizeof(struct virtio_crypto_akcipher_session_para) is less than\nsizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from\nstack variable leads stack overflow. Clang reports this issue by\ncommands:\nmake -j CC=clang-14 mrproper \u0026gt;/dev/null 2\u0026gt;\u0026amp;1\nmake -j O=/tmp/crypto-build CC=clang-14 allmodconfig \u0026gt;/dev/null 2\u0026gt;\u0026amp;1\nmake -j O=/tmp/crypto-build W=1 CC=clang-14 drivers/crypto/virtio/\n  virtio_crypto_akcipher_algs.o(CVE-2024-26753)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix possible deadlock in subflow diag\n\nSyzbot and Eric reported a lockdep splat in the subflow diag:\n\n   WARNING: possible circular locking dependency detected\n   6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted\n\n   syz-executor.2/24141 is trying to acquire lock:\n   ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:\n   tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]\n   ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:\n   tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137\n\n   but task is already holding lock:\n   ffffc9000135e488 (\u0026amp;h-\u0026gt;lhash2[i].lock){+.+.}-{2:2}, at: spin_lock\n   include/linux/spinlock.h:351 [inline]\n   ffffc9000135e488 (\u0026amp;h-\u0026gt;lhash2[i].lock){+.+.}-{2:2}, at:\n   inet_diag_dump_icsk+0x39f/0x1f80 net/ipv4/inet_diag.c:1038\n\n   which lock already depends on the new lock.\n\n   the existing dependency chain (in reverse order) is:\n\n   -\u0026gt; #1 (\u0026amp;h-\u0026gt;lhash2[i].lock){+.+.}-{2:2}:\n   lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754\n   __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]\n   _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154\n   spin_lock include/linux/spinlock.h:351 [inline]\n   __inet_hash+0x335/0xbe0 net/ipv4/inet_hashtables.c:743\n   inet_csk_listen_start+0x23a/0x320 net/ipv4/inet_connection_sock.c:1261\n   __inet_listen_sk+0x2a2/0x770 net/ipv4/af_inet.c:217\n   inet_listen+0xa3/0x110 net/ipv4/af_inet.c:239\n   rds_tcp_listen_init+0x3fd/0x5a0 net/rds/tcp_listen.c:316\n   rds_tcp_init_net+0x141/0x320 net/rds/tcp.c:577\n   ops_init+0x352/0x610 net/core/net_namespace.c:136\n   __register_pernet_operations net/core/net_namespace.c:1214 [inline]\n   register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283\n   register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370\n   rds_tcp_init+0x62/0xd0 net/rds/tcp.c:735\n   do_one_initcall+0x238/0x830 init/main.c:1236\n   do_initcall_level+0x157/0x210 init/main.c:1298\n   do_initcalls+0x3f/0x80 init/main.c:1314\n   kernel_init_freeable+0x42f/0x5d0 init/main.c:1551\n   kernel_init+0x1d/0x2a0 init/main.c:1441\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242\n\n   -\u0026gt; #0 (k-sk_lock-AF_INET6){+.+.}-{0:0}:\n   check_prev_add kernel/locking/lockdep.c:3134 [inline]\n   check_prevs_add kernel/locking/lockdep.c:3253 [inline]\n   validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869\n   __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137\n   lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754\n   lock_sock_fast include/net/sock.h:1723 [inline]\n   subflow_get_info+0x166/0xd20 net/mptcp/diag.c:28\n   tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]\n   tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137\n   inet_sk_diag_fill+0x10ed/0x1e00 net/ipv4/inet_diag.c:345\n   inet_diag_dump_icsk+0x55b/0x1f80 net/ipv4/inet_diag.c:1061\n   __inet_diag_dump+0x211/0x3a0 net/ipv4/inet_diag.c:1263\n   inet_diag_dump_compat+0x1c1/0x2d0 net/ipv4/inet_diag.c:1371\n   netlink_dump+0x59b/0xc80 net/netlink/af_netlink.c:2264\n   __netlink_dump_start+0x5df/0x790 net/netlink/af_netlink.c:2370\n   netlink_dump_start include/linux/netlink.h:338 [inline]\n   inet_diag_rcv_msg_compat+0x209/0x4c0 net/ipv4/inet_diag.c:1405\n   sock_diag_rcv_msg+0xe7/0x410\n   netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n   sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280\n   netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n   netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n   netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n   sock_sendmsg_nosec net/socket.c:730 [inline]\n   __sock_sendmsg+0x221/0x270 net/socket.c:745\n   ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n   ___sys_sendmsg net/socket.c:2638 [inline]\n   __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n   do_syscall_64+0xf9/0x240\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n\nAs noted by Eric we can break the lock dependency chain avoid\ndumping \n---truncated---(CVE-2024-26781)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read\n\nThere is chip (ls1028a) errata:\n\nThe SoC may hang on 16 byte unaligned read transactions by QDMA.\n\nUnaligned read transactions initiated by QDMA may stall in the NOC\n(Network On-Chip), causing a deadlock condition. Stalled transactions will\ntrigger completion timeouts in PCIe controller.\n\nWorkaround:\nEnable prefetch by setting the source descriptor prefetchable bit\n( SD[PF] = 1 ).\n\nImplement this workaround.(CVE-2024-26790)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\n\nThe gtp_link_ops operations structure for the subsystem must be\nregistered after registering the gtp_net_ops pernet operations structure.\n\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\n\n[ 1010.702740] gtp: GTP module unloaded\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\n[ 1010.715968] PKRU: 55555554\n[ 1010.715972] Call Trace:\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\n[ 1010.715995]  ? die_addr+0x43/0x70\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\n[ 1010.716233]  netlink_unicast+0x54b/0x800\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\n[ 1010.716269]  ? __import_iovec+0x292/0x510\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\n[ 1010.716337]  ? lockdep_init_map\n---truncated---(CVE-2024-26793)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial out-of-bounds when buffer offset is invalid\n\nI found potencial out-of-bounds when buffer offset fields of a few requests\nis invalid. This patch set the minimum value of buffer offset field to\n-\u0026gt;Buffer offset to validate buffer length.(CVE-2024-26952)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: Get runtime PM before walking tree during disable_unused\n\nDoug reported [1] the following hung task:\n\n INFO: task swapper/0:1 blocked for more than 122 seconds.\n       Not tainted 5.15.149-21875-gf795ebc40eb8 #1\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:swapper/0       state:D stack:    0 pid:    1 ppid:     0 flags:0x00000008\n Call trace:\n  __switch_to+0xf4/0x1f4\n  __schedule+0x418/0xb80\n  schedule+0x5c/0x10c\n  rpm_resume+0xe0/0x52c\n  rpm_resume+0x178/0x52c\n  __pm_runtime_resume+0x58/0x98\n  clk_pm_runtime_get+0x30/0xb0\n  clk_disable_unused_subtree+0x58/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused+0x4c/0xe4\n  do_one_initcall+0xcc/0x2d8\n  do_initcall_level+0xa4/0x148\n  do_initcalls+0x5c/0x9c\n  do_basic_setup+0x24/0x30\n  kernel_init_freeable+0xec/0x164\n  kernel_init+0x28/0x120\n  ret_from_fork+0x10/0x20\n INFO: task kworker/u16:0:9 blocked for more than 122 seconds.\n       Not tainted 5.15.149-21875-gf795ebc40eb8 #1\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:kworker/u16:0   state:D stack:    0 pid:    9 ppid:     2 flags:0x00000008\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __switch_to+0xf4/0x1f4\n  __schedule+0x418/0xb80\n  schedule+0x5c/0x10c\n  schedule_preempt_disabled+0x2c/0x48\n  __mutex_lock+0x238/0x488\n  __mutex_lock_slowpath+0x1c/0x28\n  mutex_lock+0x50/0x74\n  clk_prepare_lock+0x7c/0x9c\n  clk_core_prepare_lock+0x20/0x44\n  clk_prepare+0x24/0x30\n  clk_bulk_prepare+0x40/0xb0\n  mdss_runtime_resume+0x54/0x1c8\n  pm_generic_runtime_resume+0x30/0x44\n  __genpd_runtime_resume+0x68/0x7c\n  genpd_runtime_resume+0x108/0x1f4\n  __rpm_callback+0x84/0x144\n  rpm_callback+0x30/0x88\n  rpm_resume+0x1f4/0x52c\n  rpm_resume+0x178/0x52c\n  __pm_runtime_resume+0x58/0x98\n  __device_attach+0xe0/0x170\n  device_initial_probe+0x1c/0x28\n  bus_probe_device+0x3c/0x9c\n  device_add+0x644/0x814\n  mipi_dsi_device_register_full+0xe4/0x170\n  devm_mipi_dsi_device_register_full+0x28/0x70\n  ti_sn_bridge_probe+0x1dc/0x2c0\n  auxiliary_bus_probe+0x4c/0x94\n  really_probe+0xcc/0x2c8\n  __driver_probe_device+0xa8/0x130\n  driver_probe_device+0x48/0x110\n  __device_attach_driver+0xa4/0xcc\n  bus_for_each_drv+0x8c/0xd8\n  __device_attach+0xf8/0x170\n  device_initial_probe+0x1c/0x28\n  bus_probe_device+0x3c/0x9c\n  deferred_probe_work_func+0x9c/0xd8\n  process_one_work+0x148/0x518\n  worker_thread+0x138/0x350\n  kthread+0x138/0x1e0\n  ret_from_fork+0x10/0x20\n\nThe first thread is walking the clk tree and calling\nclk_pm_runtime_get() to power on devices required to read the clk\nhardware via struct clk_ops::is_enabled(). This thread holds the clk\nprepare_lock, and is trying to runtime PM resume a device, when it finds\nthat the device is in the process of resuming so the thread schedule()s\naway waiting for the device to finish resuming before continuing. The\nsecond thread is runtime PM resuming the same device, but the runtime\nresume callback is calling clk_prepare(), trying to grab the\nprepare_lock waiting on the first thread.\n\nThis is a classic ABBA deadlock. To properly fix the deadlock, we must\nnever runtime PM resume or suspend a device with the clk prepare_lock\nheld. Actually doing that is near impossible today because the global\nprepare_lock would have to be dropped in the middle of the tree, the\ndevice runtime PM resumed/suspended, and then the prepare_lock grabbed\nagain to ensure consistency of the clk tree topology. If anything\nchanges with the clk tree in the meantime, we\u0026apos;ve lost and will need to\nstart the operation all over again.\n\nLuckily, most of the time we\u0026apos;re simply incrementing or decrementing the\nruntime PM count on an active device, so we don\u0026apos;t have the chance to\nschedule away with the prepare_lock held. Let\u0026apos;s fix this immediate\nproblem that can be\n---truncated---(CVE-2024-27004)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: bridge: add owner module and take its refcount\n\nThe current implementation of the fpga bridge assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module\u0026apos;s refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the bridge if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_bridge\nstruct and use it to take the module\u0026apos;s refcount. Modify the function for\nregistering a bridge to take an additional owner module parameter and\nrename it to avoid conflicts. Use the old function name for a helper macro\nthat automatically sets the module that registers the bridge as the owner.\nThis ensures compatibility with existing low-level control modules and\nreduces the chances of registering a bridge without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga bridge.\n\nOther changes: opportunistically move put_device() from __fpga_bridge_get()\nto fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since\nthe bridge device is taken in these functions.(CVE-2024-36479)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: relax socket state check at accept time.\n\nChristoph reported the following splat:\n\nWARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0\nModules linked in:\nCPU: 1 PID: 772 Comm: syz-executor510 Not tainted 6.9.0-rc7-g7da7119fe22b #56\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\nRIP: 0010:__inet_accept+0x1f4/0x4a0 net/ipv4/af_inet.c:759\nCode: 04 38 84 c0 0f 85 87 00 00 00 41 c7 04 24 03 00 00 00 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ec b7 da fd \u0026lt;0f\u0026gt; 0b e9 7f fe ff ff e8 e0 b7 da fd 0f 0b e9 fe fe ff ff 89 d9 80\nRSP: 0018:ffffc90000c2fc58 EFLAGS: 00010293\nRAX: ffffffff836bdd14 RBX: 0000000000000000 RCX: ffff888104668000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: dffffc0000000000 R08: ffffffff836bdb89 R09: fffff52000185f64\nR10: dffffc0000000000 R11: fffff52000185f64 R12: dffffc0000000000\nR13: 1ffff92000185f98 R14: ffff88810754d880 R15: ffff8881007b7800\nFS:  000000001c772880(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb9fcf2e178 CR3: 00000001045d2002 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n inet_accept+0x138/0x1d0 net/ipv4/af_inet.c:786\n do_accept+0x435/0x620 net/socket.c:1929\n __sys_accept4_file net/socket.c:1969 [inline]\n __sys_accept4+0x9b/0x110 net/socket.c:1999\n __do_sys_accept net/socket.c:2016 [inline]\n __se_sys_accept net/socket.c:2013 [inline]\n __x64_sys_accept+0x7d/0x90 net/socket.c:2013\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x58/0x100 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x4315f9\nCode: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 0f 83 ab b4 fd ff c3 66 2e 0f 1f 84 00 00 00 00\nRSP: 002b:00007ffdb26d9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002b\nRAX: ffffffffffffffda RBX: 0000000000400300 RCX: 00000000004315f9\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004\nRBP: 00000000006e1018 R08: 0000000000400300 R09: 0000000000400300\nR10: 0000000000400300 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000040cdf0 R14: 000000000040ce80 R15: 0000000000000055\n \u0026lt;/TASK\u0026gt;\n\nThe reproducer invokes shutdown() before entering the listener status.\nAfter commit 94062790aedb (\u0026quot;tcp: defer shutdown(SEND_SHUTDOWN) for\nTCP_SYN_RECV sockets\u0026quot;), the above causes the child to reach the accept\nsyscall in FIN_WAIT1 status.\n\nEric noted we can relax the existing assertion in __inet_accept()(CVE-2024-36484)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: manager: add owner module and take its refcount\n\nThe current implementation of the fpga manager assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module\u0026apos;s refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the manager if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_manager\nstruct and use it to take the module\u0026apos;s refcount. Modify the functions for\nregistering the manager to take an additional owner module parameter and\nrename them to avoid conflicts. Use the old function names for helper\nmacros that automatically set the module that registers the manager as the\nowner. This ensures compatibility with existing low-level control modules\nand reduces the chances of registering a manager without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga manager.\n\nOther changes: opportunistically move put_device() from __fpga_mgr_get() to\nfpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the\nmanager device is taken in these functions.(CVE-2024-37021)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni2c: lpi2c: Avoid calling clk_get_rate during transfer\n\nInstead of repeatedly calling clk_get_rate for each transfer, lock\nthe clock rate and cache the value.\nA deadlock has been observed while adding tlv320aic32x4 audio codec to\nthe system. When this clock provider adds its clock, the clk mutex is\nlocked already, it needs to access i2c, which in return needs the mutex\nfor clk_get_rate as well.(CVE-2024-40965)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: probes: Fix uprobes for big-endian kernels\n\nThe arm64 uprobes code is broken for big-endian kernels as it doesn\u0026apos;t\nconvert the in-memory instruction encoding (which is always\nlittle-endian) into the kernel\u0026apos;s native endianness before analyzing and\nsimulating instructions. This may result in a few distinct problems:\n\n* The kernel may may erroneously reject probing an instruction which can\n  safely be probed.\n\n* The kernel may erroneously erroneously permit stepping an\n  instruction out-of-line when that instruction cannot be stepped\n  out-of-line safely.\n\n* The kernel may erroneously simulate instruction incorrectly dur to\n  interpretting the byte-swapped encoding.\n\nThe endianness mismatch isn\u0026apos;t caught by the compiler or sparse because:\n\n* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so\n  the compiler and sparse have no idea these contain a little-endian\n  32-bit value. The core uprobes code populates these with a memcpy()\n  which similarly does not handle endianness.\n\n* While the uprobe_opcode_t type is an alias for __le32, both\n  arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[]\n  to the similarly-named probe_opcode_t, which is an alias for u32.\n  Hence there is no endianness conversion warning.\n\nFix this by changing the arch_uprobe::{insn,ixol} fields to __le32 and\nadding the appropriate __le32_to_cpu() conversions prior to consuming\nthe instruction encoding. The core uprobes copies these fields as opaque\nranges of bytes, and so is unaffected by this change.\n\nAt the same time, remove MAX_UINSN_BYTES and consistently use\nAARCH64_INSN_SIZE for clarity.\n\nTested with the following:\n\n| #include \u0026lt;stdio.h\u0026gt;\n| #include \u0026lt;stdbool.h\u0026gt;\n|\n| #define noinline __attribute__((noinline))\n|\n| static noinline void *adrp_self(void)\n| {\n|         void *addr;\n|\n|         asm volatile(\n|         \u0026quot;       adrp    %x0, adrp_self\\n\u0026quot;\n|         \u0026quot;       add     %x0, %x0, :lo12:adrp_self\\n\u0026quot;\n|         : \u0026quot;=r\u0026quot; (addr));\n| }\n|\n|\n| int main(int argc, char *argv)\n| {\n|         void *ptr = adrp_self();\n|         bool equal = (ptr == adrp_self);\n|\n|         printf(\u0026quot;adrp_self   =\u0026gt; %p\\n\u0026quot;\n|                \u0026quot;adrp_self() =\u0026gt; %p\\n\u0026quot;\n|                \u0026quot;%s\\n\u0026quot;,\n|                adrp_self, ptr, equal ? \u0026quot;EQUAL\u0026quot; : \u0026quot;NOT EQUAL\u0026quot;);\n|\n|         return 0;\n| }\n\n.... where the adrp_self() function was compiled to:\n\n| 00000000004007e0 \u0026lt;adrp_self\u0026gt;:\n|   4007e0:       90000000        adrp    x0, 400000 \u0026lt;__ehdr_start\u0026gt;\n|   4007e4:       911f8000        add     x0, x0, #0x7e0\n|   4007e8:       d65f03c0        ret\n\nBefore this patch, the ADRP is not recognized, and is assumed to be\nsteppable, resulting in corruption of the result:\n\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0x4007e0\n| EQUAL\n| # echo \u0026apos;p /root/adrp-self:0x007e0\u0026apos; \u0026gt; /sys/kernel/tracing/uprobe_events\n| # echo 1 \u0026gt; /sys/kernel/tracing/events/uprobes/enable\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0xffffffffff7e0\n| NOT EQUAL\n\nAfter this patch, the ADRP is correctly recognized and simulated:\n\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0x4007e0\n| EQUAL\n| #\n| # echo \u0026apos;p /root/adrp-self:0x007e0\u0026apos; \u0026gt; /sys/kernel/tracing/uprobe_events\n| # echo 1 \u0026gt; /sys/kernel/tracing/events/uprobes/enable\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0x4007e0\n| EQUAL(CVE-2024-50194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix flushing uninitialized delayed_work on cache_ctr error\n\nAn unexpected WARN_ON from flush_work() may occur when cache creation\nfails, caused by destroying the uninitialized delayed_work waker in the\nerror path of cache_create(). For example, the warning appears on the\nsuperblock checksum error.\n\nReproduce steps:\n\ndmsetup create cmeta --table \u0026quot;0 8192 linear /dev/sdc 0\u0026quot;\ndmsetup create cdata --table \u0026quot;0 65536 linear /dev/sdc 8192\u0026quot;\ndmsetup create corig --table \u0026quot;0 524288 linear /dev/sdc 262144\u0026quot;\ndd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \u0026quot;0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\u0026quot;\n\nKernel logs:\n\n(snip)\nWARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890\n\nFix by pulling out the cancel_delayed_work_sync() from the constructor\u0026apos;s\nerror path. This patch doesn\u0026apos;t affect the use-after-free fix for\nconcurrent dm_resume and dm_destroy (commit 6a459d8edbdb (\u0026quot;dm cache: Fix\nUAF in destroy()\u0026quot;)) as cache_dtr is not changed.(CVE-2024-50280)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix null-ptr-deref in block_touch_buffer tracepoint\n\nPatch series \u0026quot;nilfs2: fix null-ptr-deref bugs on block tracepoints\u0026quot;.\n\nThis series fixes null pointer dereference bugs that occur when using\nnilfs2 and two block-related tracepoints.\n\n\nThis patch (of 2):\n\nIt has been reported that when using \u0026quot;block:block_touch_buffer\u0026quot;\ntracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a\nNULL pointer dereference, or a general protection fault when KASAN is\nenabled.\n\nThis happens because since the tracepoint was added in touch_buffer(), it\nreferences the dev_t member bh-\u0026gt;b_bdev-\u0026gt;bd_dev regardless of whether the\nbuffer head has a pointer to a block_device structure.  In the current\nimplementation, the block_device structure is set after the function\nreturns to the caller.\n\nHere, touch_buffer() is used to mark the folio/page that owns the buffer\nhead as accessed, but the common search helper for folio/page used by the\ncaller function was optimized to mark the folio/page as accessed when it\nwas reimplemented a long time ago, eliminating the need to call\ntouch_buffer() here in the first place.\n\nSo this solves the issue by eliminating the touch_buffer() call itself.(CVE-2024-53131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: net: Do not use drvdata in release\n\nThe drvdata is not available in release. Let\u0026apos;s just use container_of()\nto get the uml_net instance. Otherwise, removing a network device will\nresult in a crash:\n\nRIP: 0033:net_device_release+0x10/0x6f\nRSP: 00000000e20c7c40  EFLAGS: 00010206\nRAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0\nRDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028\nRBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70\nR10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000\nR13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1\nWorkqueue: events mc_work_proc\nStack:\n 627af028 62c7af00 e20c7c80 60276fcd\n 62778000 603f5820 627af028 00000000\n e20c7cb0 603a2bcd 627af000 62770010\nCall Trace:\n [\u0026lt;60276fcd\u0026gt;] device_release+0x70/0xba\n [\u0026lt;603a2bcd\u0026gt;] kobject_put+0xba/0xe7\n [\u0026lt;60277265\u0026gt;] put_device+0x19/0x1c\n [\u0026lt;60281266\u0026gt;] platform_device_put+0x26/0x29\n [\u0026lt;60281e5f\u0026gt;] platform_device_unregister+0x2c/0x2e\n [\u0026lt;6002ec9c\u0026gt;] net_remove+0x63/0x69\n [\u0026lt;60031316\u0026gt;] ? mconsole_reply+0x0/0x50\n [\u0026lt;600310c8\u0026gt;] mconsole_remove+0x160/0x1cc\n [\u0026lt;60087d40\u0026gt;] ? __remove_hrtimer+0x38/0x74\n [\u0026lt;60087ff8\u0026gt;] ? hrtimer_try_to_cancel+0x8c/0x98\n [\u0026lt;6006b3cf\u0026gt;] ? dl_server_stop+0x3f/0x48\n [\u0026lt;6006b390\u0026gt;] ? dl_server_stop+0x0/0x48\n [\u0026lt;600672e8\u0026gt;] ? dequeue_entities+0x327/0x390\n [\u0026lt;60038fa6\u0026gt;] ? um_set_signals+0x0/0x43\n [\u0026lt;6003070c\u0026gt;] mc_work_proc+0x77/0x91\n [\u0026lt;60057664\u0026gt;] process_scheduled_works+0x1b3/0x2dd\n [\u0026lt;60055f32\u0026gt;] ? assign_work+0x0/0x58\n [\u0026lt;60057f0a\u0026gt;] worker_thread+0x1e9/0x293\n [\u0026lt;6005406f\u0026gt;] ? set_pf_worker+0x0/0x64\n [\u0026lt;6005d65d\u0026gt;] ? arch_local_irq_save+0x0/0x2d\n [\u0026lt;6005d748\u0026gt;] ? kthread_exit+0x0/0x3a\n [\u0026lt;60057d21\u0026gt;] ? worker_thread+0x0/0x293\n [\u0026lt;6005dbf1\u0026gt;] kthread+0x126/0x12b\n [\u0026lt;600219c5\u0026gt;] new_thread_handler+0x85/0xb6(CVE-2024-53183)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen: Fix the issue of resource not being properly released in xenbus_dev_probe()\n\nThis patch fixes an issue in the function xenbus_dev_probe(). In the\nxenbus_dev_probe() function, within the if (err) branch at line 313, the\nprogram incorrectly returns err directly without releasing the resources\nallocated by err = drv-\u0026gt;probe(dev, id). As the return value is non-zero,\nthe upper layers assume the processing logic has failed. However, the probe\noperation was performed earlier without a corresponding remove operation.\nSince the probe actually allocates resources, failing to perform the remove\noperation could lead to problems.\n\nTo fix this issue, we followed the resource release logic of the\nxenbus_dev_remove() function by adding a new block fail_remove before the\nfail_put block. After entering the branch if (err) at line 313, the\nfunction will use a goto statement to jump to the fail_remove block,\nensuring that the previously acquired resources are correctly released,\nthus preventing the reference count leak.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch.(CVE-2024-53198)\n\nIn the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipeThis commit addresses a null pointer dereference issue indcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ( drm/amd/display:Add null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipe )partially fixed the null pointer dereference issue. However, indcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, andplane_state is accessed again through pipe_ctx. Multiple if statementsdirectly call attributes of plane_state, leading to potential nullpointer dereference issues. This patch adds necessary null checks toensure stability.(CVE-2024-53201)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()\n\nReplace one-element array with a flexible-array member in `struct\nmwifiex_ie_types_wildcard_ssid_params` to fix the following warning\non a MT8173 Chromebook (mt8173-elm-hana):\n\n[  356.775250] ------------[ cut here ]------------\n[  356.784543] memcpy: detected field-spanning write (size 6) of single field \u0026quot;wildcard_ssid_tlv-\u0026gt;ssid\u0026quot; at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1)\n[  356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]\n\nThe \u0026quot;(size 6)\u0026quot; above is exactly the length of the SSID of the network\nthis device was connected to. The source of the warning looks like:\n\n    ssid_len = user_scan_in-\u0026gt;ssid_list[i].ssid_len;\n    [...]\n    memcpy(wildcard_ssid_tlv-\u0026gt;ssid,\n           user_scan_in-\u0026gt;ssid_list[i].ssid, ssid_len);\n\nThere is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this\nstruct, but it already didn\u0026apos;t account for the size of the one-element\narray, so it doesn\u0026apos;t need to be changed.(CVE-2024-56539)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Require entities to have a non-zero unique ID\n\nPer UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero\nunique ID.\n\n```\nEach Unit and Terminal within the video function is assigned a unique\nidentification number, the Unit ID (UID) or Terminal ID (TID), contained in\nthe bUnitID or bTerminalID field of the descriptor. The value 0x00 is\nreserved for undefined ID,\n```\n\nSo, deny allocating an entity with ID 0 or an ID that belongs to a unit\nthat is already added to the list of entities.\n\nThis also prevents some syzkaller reproducers from triggering warnings due\nto a chain of entities referring to themselves. In one particular case, an\nOutput Unit is connected to an Input Unit, both with the same ID of 1. But\nwhen looking up for the source ID of the Output Unit, that same entity is\nfound instead of the input entity, which leads to such warnings.\n\nIn another case, a backward chain was considered finished as the source ID\nwas 0. Later on, that entity was found, but its pads were not valid.\n\nHere is a sample stack trace for one of those cases.\n\n[   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd\n[   20.830206] usb 1-1: Using ep0 maxpacket: 8\n[   20.833501] usb 1-1: config 0 descriptor??\n[   21.038518] usb 1-1: string descriptor 0 read error: -71\n[   21.038893] usb 1-1: Found UVC 0.00 device \u0026lt;unnamed\u0026gt; (2833:0201)\n[   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!\n[   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!\n[   21.042218] ------------[ cut here ]------------\n[   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0\n[   21.043195] Modules linked in:\n[   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444\n[   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[   21.044639] Workqueue: usb_hub_wq hub_event\n[   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0\n[   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 \u0026lt;0f\u0026gt; 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00\n[   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246\n[   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1\n[   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290\n[   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000\n[   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003\n[   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000\n[   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000\n[   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0\n[   21.051136] PKRU: 55555554\n[   21.051331] Call Trace:\n[   21.051480]  \u0026lt;TASK\u0026gt;\n[   21.051611]  ? __warn+0xc4/0x210\n[   21.051861]  ? media_create_pad_link+0x2c4/0x2e0\n[   21.052252]  ? report_bug+0x11b/0x1a0\n[   21.052540]  ? trace_hardirqs_on+0x31/0x40\n[   21.052901]  ? handle_bug+0x3d/0x70\n[   21.053197]  ? exc_invalid_op+0x1a/0x50\n[   21.053511]  ? asm_exc_invalid_op+0x1a/0x20\n[   21.053924]  ? media_create_pad_link+0x91/0x2e0\n[   21.054364]  ? media_create_pad_link+0x2c4/0x2e0\n[   21.054834]  ? media_create_pad_link+0x91/0x2e0\n[   21.055131]  ? _raw_spin_unlock+0x1e/0x40\n[   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210\n[   21.055837]  uvc_mc_register_entities+0x358/0x400\n[   21.056144]  uvc_register_chains+0x1fd/0x290\n[   21.056413]  uvc_probe+0x380e/0x3dc0\n[   21.056676]  ? __lock_acquire+0x5aa/0x26e0\n[   21.056946]  ? find_held_lock+0x33/0xa0\n[   21.057196]  ? kernfs_activate+0x70/0x80\n[   21.057533]  ? usb_match_dy\n---truncated---(CVE-2024-56571)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Create all dump files during debugfs initialization\n\nFor the current debugfs of hisi_sas, after user triggers dump, the\ndriver allocate memory space to save the register information and create\ndebugfs files to display the saved information. In this process, the\ndebugfs files created after each dump.\n\nTherefore, when the dump is triggered while the driver is unbind, the\nfollowing hang occurs:\n\n[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0\n[67840.862947] Mem abort info:\n[67840.865855]   ESR = 0x0000000096000004\n[67840.869713]   EC = 0x25: DABT (current EL), IL = 32 bits\n[67840.875125]   SET = 0, FnV = 0\n[67840.878291]   EA = 0, S1PTW = 0\n[67840.881545]   FSC = 0x04: level 0 translation fault\n[67840.886528] Data abort info:\n[67840.889524]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[67840.895117]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[67840.900284]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000\n[67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000\n[67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[67841.003628] pc : down_write+0x30/0x98\n[67841.007546] lr : start_creating.part.0+0x60/0x198\n[67841.012495] sp : ffff8000b979ba20\n[67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40\n[67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8\n[67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18\n[67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020\n[67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff\n[67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18\n[67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18\n[67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9\n[67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001\n[67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0\n[67841.089759] Call trace:\n[67841.092456]  down_write+0x30/0x98\n[67841.096017]  start_creating.part.0+0x60/0x198\n[67841.100613]  debugfs_create_dir+0x48/0x1f8\n[67841.104950]  debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw]\n[67841.111447]  debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw]\n[67841.118111]  debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw]\n[67841.125115]  full_proxy_write+0x68/0xc8\n[67841.129175]  vfs_write+0xd8/0x3f0\n[67841.132708]  ksys_write+0x70/0x108\n[67841.136317]  __arm64_sys_write+0x24/0x38\n[67841.140440]  invoke_syscall+0x50/0x128\n[67841.144385]  el0_svc_common.constprop.0+0xc8/0xf0\n[67841.149273]  do_el0_svc+0x24/0x38\n[67841.152773]  el0_svc+0x38/0xd8\n[67841.156009]  el0t_64_sync_handler+0xc0/0xc8\n[67841.160361]  el0t_64_sync+0x1a4/0x1a8\n[67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05)\n[67841.170443] ---[ end trace 0000000000000000 ]---\n\nTo fix this issue, create all directories and files during debugfs\ninitialization. In this way, the driver only needs to allocate memory\nspace to save information each time the user triggers dumping.(CVE-2024-56588)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nkcsan: Turn report_filterlist_lock into a raw_spinlock\n\nRan Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see\nsplats like:\n\n| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n| in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1\n| preempt_count: 10002, expected: 0\n| RCU nest depth: 0, expected: 0\n| no locks held by swapper/1/0.\n| irq event stamp: 156674\n| hardirqs last  enabled at (156673): [\u0026lt;ffffffff81130bd9\u0026gt;] do_idle+0x1f9/0x240\n| hardirqs last disabled at (156674): [\u0026lt;ffffffff82254f84\u0026gt;] sysvec_apic_timer_interrupt+0x14/0xc0\n| softirqs last  enabled at (0): [\u0026lt;ffffffff81099f47\u0026gt;] copy_process+0xfc7/0x4b60\n| softirqs last disabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n| Preemption disabled at:\n| [\u0026lt;ffffffff814a3e2a\u0026gt;] paint_ptr+0x2a/0x90\n| CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.11.0+ #3\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014\n| Call Trace:\n|  \u0026lt;IRQ\u0026gt;\n|  dump_stack_lvl+0x7e/0xc0\n|  dump_stack+0x1d/0x30\n|  __might_resched+0x1a2/0x270\n|  rt_spin_lock+0x68/0x170\n|  kcsan_skip_report_debugfs+0x43/0xe0\n|  print_report+0xb5/0x590\n|  kcsan_report_known_origin+0x1b1/0x1d0\n|  kcsan_setup_watchpoint+0x348/0x650\n|  __tsan_unaligned_write1+0x16d/0x1d0\n|  hrtimer_interrupt+0x3d6/0x430\n|  __sysvec_apic_timer_interrupt+0xe8/0x3a0\n|  sysvec_apic_timer_interrupt+0x97/0xc0\n|  \u0026lt;/IRQ\u0026gt;\n\nOn a detected data race, KCSAN\u0026apos;s reporting logic checks if it should\nfilter the report. That list is protected by the report_filterlist_lock\n*non-raw* spinlock which may sleep on RT kernels.\n\nSince KCSAN may report data races in any context, convert it to a\nraw_spinlock.\n\nThis requires being careful about when to allocate memory for the filter\nlist itself which can be done via KCSAN\u0026apos;s debugfs interface. Concurrent\nmodification of the filter list via debugfs should be rare: the chosen\nstrategy is to optimistically pre-allocate memory before the critical\nsection and discard if unused.(CVE-2024-56610)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM\n\nWe currently assume that there is at least one VMA in a MM, which isn\u0026apos;t\ntrue.\n\nSo we might end up having find_vma() return NULL, to then de-reference\nNULL.  So properly handle find_vma() returning NULL.\n\nThis fixes the report:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nRIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]\nRIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194\nCode: ...\nRSP: 0018:ffffc9000375fd08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000\nRDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044\nRBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1\nR10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003\nR13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8\nFS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709\n __do_sys_migrate_pages mm/mempolicy.c:1727 [inline]\n __se_sys_migrate_pages mm/mempolicy.c:1723 [inline]\n __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[akpm@linux-foundation.org: add unlikely()](CVE-2024-56611)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use after free on unload\n\nSystem crash is observed with stack trace warning of use after\nfree. There are 2 signals to tell dpc_thread to terminate (UNLOADING\nflag and kthread_stop).\n\nOn setting the UNLOADING flag when dpc_thread happens to run at the time\nand sees the flag, this causes dpc_thread to exit and clean up\nitself. When kthread_stop is called for final cleanup, this causes use\nafter free.\n\nRemove UNLOADING signal to terminate dpc_thread.  Use the kthread_stop\nas the main signal to exit dpc_thread.\n\n[596663.812935] kernel BUG at mm/slub.c:294!\n[596663.812950] invalid opcode: 0000 [#1] SMP PTI\n[596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-240.el8.x86_64 #1\n[596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012\n[596663.812974] RIP: 0010:__slab_free+0x17d/0x360\n\n...\n[596663.813008] Call Trace:\n[596663.813022]  ? __dentry_kill+0x121/0x170\n[596663.813030]  ? _cond_resched+0x15/0x30\n[596663.813034]  ? _cond_resched+0x15/0x30\n[596663.813039]  ? wait_for_completion+0x35/0x190\n[596663.813048]  ? try_to_wake_up+0x63/0x540\n[596663.813055]  free_task+0x5a/0x60\n[596663.813061]  kthread_stop+0xf3/0x100\n[596663.813103]  qla2x00_remove_one+0x284/0x440 [qla2xxx](CVE-2024-56623)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport\n\nSince transport-\u0026gt;sock has been set to NULL during reset transport,\nXPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the\nxs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request()\nto dereference the transport-\u0026gt;sock that has been set to NULL.(CVE-2024-56688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\n9p/xen: fix release of IRQ\n\nKernel logs indicate an IRQ was double-freed.\n\nPass correct device ID during IRQ release.\n\n[Dominique: remove confusing variable reset to 0](CVE-2024-56704)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nionic: Fix netdev notifier unregister on failure\n\nIf register_netdev() fails, then the driver leaks the netdev notifier.\nFix this by calling ionic_lif_unregister() on register_netdev()\nfailure. This will also call ionic_lif_unregister_phc() if it has\nalready been registered.(CVE-2024-56715)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()\n\nWhen information such as info-\u0026gt;screen_base is not ready, calling\nsh7760fb_free_mem() does not release memory correctly. Call\ndma_free_coherent() instead.(CVE-2024-56746)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\n\nWhen mounting ocfs2 and then remounting it as read-only, a\nslab-use-after-free occurs after the user uses a syscall to\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u0026gt;dqi_priv is the\ndangling pointer.\n\nDuring the remounting process, the pointer dqi_priv is freed but is never\nset as null leaving it to be accessed.  Additionally, the read-only option\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\nnext quota, the function ocfs2_get_next_id is called and only checks the\nquota usage flags and not the quota suspended flags.\n\nTo fix this, I set dqi_priv to null when it is freed after remounting with\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\n\n[akpm@linux-foundation.org: coding-style cleanups](CVE-2024-57892)","status":"published","published":"2025-02-08T11:08:11Z","modified":"2026-08-18T01:17:43.09203885Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1096","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOBs in smb2_parse_contexts()\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n  BUG: unable to handle page fault for address: ffff8881178d8cc3\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 4a01067 P4D 4a01067 PUD 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 \u0026lt;0f\u0026gt; b7\n  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n  R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n  R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n  PKRU: 55555554\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ? __die+0x23/0x70\n   ? page_fault_oops+0x181/0x480\n   ? search_module_extables+0x19/0x60\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? exc_page_fault+0x1b6/0x1c0\n   ? asm_exc_page_fault+0x26/0x30\n   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n   SMB2_open+0x38d/0x5f0 [cifs]\n   ? smb2_is_path_accessible+0x138/0x260 [cifs]\n   smb2_is_path_accessible+0x138/0x260 [cifs]\n   cifs_is_path_remote+0x8d/0x230 [cifs]\n   cifs_mount+0x7e/0x350 [cifs]\n   cifs_smb3_do_mount+0x128/0x780 [cifs]\n   smb3_get_tree+0xd9/0x290 [cifs]\n   vfs_get_tree+0x2c/0x100\n   ? capable+0x37/0x70\n   path_mount+0x2d7/0xb80\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? _raw_spin_unlock_irqrestore+0x44/0x60\n   __x64_sys_mount+0x11a/0x150\n   do_syscall_64+0x47/0xf0\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n  RIP: 0033:0x7f8737657b1e(CVE-2023-52434)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix race condition between session lookup and expire\n\n Thread A                        +  Thread B\n ksmbd_session_lookup            |  smb2_sess_setup\n   sess = xa_load                |\n                                 |\n                                 |    xa_erase(\u0026amp;conn-\u0026gt;sessions, sess-\u0026gt;id);\n                                 |\n                                 |    ksmbd_session_destroy(sess) --\u0026gt; kfree(sess)\n                                 |\n   // UAF!                       |\n   sess-\u0026gt;last_active = jiffies   |\n                                 +\n\nThis patch add rwsem to fix race condition between ksmbd_session_lookup\nand ksmbd_expire_session.(CVE-2023-52480)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Fix buffer overflow in trans_stat_show\n\nFix buffer overflow in trans_stat_show().\n\nConvert simple snprintf to the more secure scnprintf with size of\nPAGE_SIZE.\n\nAdd condition checking if we are exceeding PAGE_SIZE and exit early from\nloop. Also add at the end a warning that we exceeded PAGE_SIZE and that\nstats is disabled.\n\nReturn -EFBIG in the case where we don\u0026apos;t have enough space to write the\nfull transition table.\n\nAlso document in the ABI that this function can return -EFBIG error.(CVE-2023-52614)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7091r: Allow users to configure device events\n\nAD7091R-5 devices are supported by the ad7091r-5 driver together with\nthe ad7091r-base driver. Those drivers declared iio events for notifying\nuser space when ADC readings fall bellow the thresholds of low limit\nregisters or above the values set in high limit registers.\nHowever, to configure iio events and their thresholds, a set of callback\nfunctions must be implemented and those were not present until now.\nThe consequence of trying to configure ad7091r-5 events without the\nproper callback functions was a null pointer dereference in the kernel\nbecause the pointers to the callback functions were not set.\n\nImplement event configuration callbacks allowing users to read/write\nevent thresholds and enable/disable event generation.\n\nSince the event spec structs are generic to AD7091R devices, also move\nthose from the ad7091r-5 driver the base driver so they can be reused\nwhen support for ad7091r-2/-4/-8 be added.(CVE-2023-52627)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential context UAFs\n\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this.  And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)(CVE-2023-52913)\n\nA race condition was found in the Linux kernel\u0026apos;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.\n\n\n\n\n(CVE-2024-24857)\n\nA race condition was found in the Linux kernel\u0026apos;s net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.\n\n\n\n\n\n\n\n(CVE-2024-24859)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxhci: handle isoc Babble and Buffer Overrun events properly\n\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\nownership of a multi-TRB TD when it reports an error on one of the\nearly TRBs. Yet the driver makes such assumption and releases the TD,\nallowing the remaining TRBs to be freed or overwritten by new TDs.\n\nThe xHC should also report completion of the final TRB due to its IOC\nflag being set by us, regardless of prior errors. This event cannot\nbe recognized if the TD has already been freed earlier, resulting in\n\u0026quot;Transfer event TRB DMA ptr not part of current TD\u0026quot; error message.\n\nFix this by reusing the logic for processing isoc Transaction Errors.\nThis also handles hosts which fail to report the final completion.\n\nFix transfer length reporting on Babble errors. They may be caused by\ndevice malfunction, no guarantee that the buffer has been filled.(CVE-2024-26659)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) Fix out-of-bounds memory access\n\nFix a bug that pdata-\u0026gt;cpu_map[] is set before out-of-bounds check.\nThe problem might be triggered on systems with more than 128 cores per\npackage.(CVE-2024-26664)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations\n\n- Disallow families other than NFPROTO_{IPV4,IPV6,INET}.\n- Disallow layer 4 protocol with no ports, since destination port is a\n  mandatory attribute for this object.(CVE-2024-26673)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: roles: fix NULL pointer issue when put module\u0026apos;s reference\n\nIn current design, usb role class driver will get usb_role_switch parent\u0026apos;s\nmodule reference after the user get usb_role_switch device and put the\nreference after the user put the usb_role_switch device. However, the\nparent device of usb_role_switch may be removed before the user put the\nusb_role_switch. If so, then, NULL pointer issue will be met when the user\nput the parent module\u0026apos;s reference.\n\nThis will save the module pointer in structure of usb_role_switch. Then,\nwe don\u0026apos;t need to find module by iterating long relations.(CVE-2024-26747)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix memory double free when handle zero packet\n\n829  if (request-\u0026gt;complete) {\n830          spin_unlock(\u0026amp;priv_dev-\u0026gt;lock);\n831          usb_gadget_giveback_request(\u0026amp;priv_ep-\u0026gt;endpoint,\n832                                    request);\n833          spin_lock(\u0026amp;priv_dev-\u0026gt;lock);\n834  }\n835\n836  if (request-\u0026gt;buf == priv_dev-\u0026gt;zlp_buf)\n837      cdns3_gadget_ep_free_request(\u0026amp;priv_ep-\u0026gt;endpoint, request);\n\nDriver append an additional zero packet request when queue a packet, which\nlength mod max packet size is 0. When transfer complete, run to line 831,\nusb_gadget_giveback_request() will free this requestion. 836 condition is\ntrue, so cdns3_gadget_ep_free_request() free this request again.\n\nLog:\n\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.140696][  T150]\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\n\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\nadditional zero length packet request. Needn\u0026apos;t call\nusb_gadget_giveback_request() because it is allocated in this driver.(CVE-2024-26748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()\n\n  ...\n  cdns3_gadget_ep_free_request(\u0026amp;priv_ep-\u0026gt;endpoint, \u0026amp;priv_req-\u0026gt;request);\n  list_del_init(\u0026amp;priv_req-\u0026gt;list);\n  ...\n\n\u0026apos;priv_req\u0026apos; actually free at cdns3_gadget_ep_free_request(). But\nlist_del_init() use priv_req-\u0026gt;list after it.\n\n[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4\n[ 1542.642868][  T534]\n[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):\n[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4\n[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]\n[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4\n[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8\n[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368\n[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28\n\nMove list_del_init() before cdns3_gadget_ep_free_request() to resolve this\nproblem.(CVE-2024-26749)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: virtio/akcipher - Fix stack overflow on memcpy\n\nsizeof(struct virtio_crypto_akcipher_session_para) is less than\nsizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from\nstack variable leads stack overflow. Clang reports this issue by\ncommands:\nmake -j CC=clang-14 mrproper \u0026gt;/dev/null 2\u0026gt;\u0026amp;1\nmake -j O=/tmp/crypto-build CC=clang-14 allmodconfig \u0026gt;/dev/null 2\u0026gt;\u0026amp;1\nmake -j O=/tmp/crypto-build W=1 CC=clang-14 drivers/crypto/virtio/\n  virtio_crypto_akcipher_algs.o(CVE-2024-26753)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix possible deadlock in subflow diag\n\nSyzbot and Eric reported a lockdep splat in the subflow diag:\n\n   WARNING: possible circular locking dependency detected\n   6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted\n\n   syz-executor.2/24141 is trying to acquire lock:\n   ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:\n   tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]\n   ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:\n   tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137\n\n   but task is already holding lock:\n   ffffc9000135e488 (\u0026amp;h-\u0026gt;lhash2[i].lock){+.+.}-{2:2}, at: spin_lock\n   include/linux/spinlock.h:351 [inline]\n   ffffc9000135e488 (\u0026amp;h-\u0026gt;lhash2[i].lock){+.+.}-{2:2}, at:\n   inet_diag_dump_icsk+0x39f/0x1f80 net/ipv4/inet_diag.c:1038\n\n   which lock already depends on the new lock.\n\n   the existing dependency chain (in reverse order) is:\n\n   -\u0026gt; #1 (\u0026amp;h-\u0026gt;lhash2[i].lock){+.+.}-{2:2}:\n   lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754\n   __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]\n   _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154\n   spin_lock include/linux/spinlock.h:351 [inline]\n   __inet_hash+0x335/0xbe0 net/ipv4/inet_hashtables.c:743\n   inet_csk_listen_start+0x23a/0x320 net/ipv4/inet_connection_sock.c:1261\n   __inet_listen_sk+0x2a2/0x770 net/ipv4/af_inet.c:217\n   inet_listen+0xa3/0x110 net/ipv4/af_inet.c:239\n   rds_tcp_listen_init+0x3fd/0x5a0 net/rds/tcp_listen.c:316\n   rds_tcp_init_net+0x141/0x320 net/rds/tcp.c:577\n   ops_init+0x352/0x610 net/core/net_namespace.c:136\n   __register_pernet_operations net/core/net_namespace.c:1214 [inline]\n   register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283\n   register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370\n   rds_tcp_init+0x62/0xd0 net/rds/tcp.c:735\n   do_one_initcall+0x238/0x830 init/main.c:1236\n   do_initcall_level+0x157/0x210 init/main.c:1298\n   do_initcalls+0x3f/0x80 init/main.c:1314\n   kernel_init_freeable+0x42f/0x5d0 init/main.c:1551\n   kernel_init+0x1d/0x2a0 init/main.c:1441\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242\n\n   -\u0026gt; #0 (k-sk_lock-AF_INET6){+.+.}-{0:0}:\n   check_prev_add kernel/locking/lockdep.c:3134 [inline]\n   check_prevs_add kernel/locking/lockdep.c:3253 [inline]\n   validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869\n   __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137\n   lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754\n   lock_sock_fast include/net/sock.h:1723 [inline]\n   subflow_get_info+0x166/0xd20 net/mptcp/diag.c:28\n   tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]\n   tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137\n   inet_sk_diag_fill+0x10ed/0x1e00 net/ipv4/inet_diag.c:345\n   inet_diag_dump_icsk+0x55b/0x1f80 net/ipv4/inet_diag.c:1061\n   __inet_diag_dump+0x211/0x3a0 net/ipv4/inet_diag.c:1263\n   inet_diag_dump_compat+0x1c1/0x2d0 net/ipv4/inet_diag.c:1371\n   netlink_dump+0x59b/0xc80 net/netlink/af_netlink.c:2264\n   __netlink_dump_start+0x5df/0x790 net/netlink/af_netlink.c:2370\n   netlink_dump_start include/linux/netlink.h:338 [inline]\n   inet_diag_rcv_msg_compat+0x209/0x4c0 net/ipv4/inet_diag.c:1405\n   sock_diag_rcv_msg+0xe7/0x410\n   netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n   sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280\n   netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n   netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n   netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n   sock_sendmsg_nosec net/socket.c:730 [inline]\n   __sock_sendmsg+0x221/0x270 net/socket.c:745\n   ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n   ___sys_sendmsg net/socket.c:2638 [inline]\n   __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n   do_syscall_64+0xf9/0x240\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n\nAs noted by Eric we can break the lock dependency chain avoid\ndumping \n---truncated---(CVE-2024-26781)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read\n\nThere is chip (ls1028a) errata:\n\nThe SoC may hang on 16 byte unaligned read transactions by QDMA.\n\nUnaligned read transactions initiated by QDMA may stall in the NOC\n(Network On-Chip), causing a deadlock condition. Stalled transactions will\ntrigger completion timeouts in PCIe controller.\n\nWorkaround:\nEnable prefetch by setting the source descriptor prefetchable bit\n( SD[PF] = 1 ).\n\nImplement this workaround.(CVE-2024-26790)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\n\nThe gtp_link_ops operations structure for the subsystem must be\nregistered after registering the gtp_net_ops pernet operations structure.\n\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\n\n[ 1010.702740] gtp: GTP module unloaded\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\n[ 1010.715968] PKRU: 55555554\n[ 1010.715972] Call Trace:\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\n[ 1010.715995]  ? die_addr+0x43/0x70\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\n[ 1010.716233]  netlink_unicast+0x54b/0x800\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\n[ 1010.716269]  ? __import_iovec+0x292/0x510\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\n[ 1010.716337]  ? lockdep_init_map\n---truncated---(CVE-2024-26793)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial out-of-bounds when buffer offset is invalid\n\nI found potencial out-of-bounds when buffer offset fields of a few requests\nis invalid. This patch set the minimum value of buffer offset field to\n-\u0026gt;Buffer offset to validate buffer length.(CVE-2024-26952)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()\n\nIf -\u0026gt;NameOffset of smb2_create_req is smaller than Buffer offset of\nsmb2_create_req, slab-out-of-bounds read can happen from smb2_open.\nThis patch set the minimum value of the name offset to the buffer offset\nto validate name length of smb2_create_req().(CVE-2024-26954)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: Get runtime PM before walking tree during disable_unused\n\nDoug reported [1] the following hung task:\n\n INFO: task swapper/0:1 blocked for more than 122 seconds.\n       Not tainted 5.15.149-21875-gf795ebc40eb8 #1\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:swapper/0       state:D stack:    0 pid:    1 ppid:     0 flags:0x00000008\n Call trace:\n  __switch_to+0xf4/0x1f4\n  __schedule+0x418/0xb80\n  schedule+0x5c/0x10c\n  rpm_resume+0xe0/0x52c\n  rpm_resume+0x178/0x52c\n  __pm_runtime_resume+0x58/0x98\n  clk_pm_runtime_get+0x30/0xb0\n  clk_disable_unused_subtree+0x58/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused+0x4c/0xe4\n  do_one_initcall+0xcc/0x2d8\n  do_initcall_level+0xa4/0x148\n  do_initcalls+0x5c/0x9c\n  do_basic_setup+0x24/0x30\n  kernel_init_freeable+0xec/0x164\n  kernel_init+0x28/0x120\n  ret_from_fork+0x10/0x20\n INFO: task kworker/u16:0:9 blocked for more than 122 seconds.\n       Not tainted 5.15.149-21875-gf795ebc40eb8 #1\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:kworker/u16:0   state:D stack:    0 pid:    9 ppid:     2 flags:0x00000008\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __switch_to+0xf4/0x1f4\n  __schedule+0x418/0xb80\n  schedule+0x5c/0x10c\n  schedule_preempt_disabled+0x2c/0x48\n  __mutex_lock+0x238/0x488\n  __mutex_lock_slowpath+0x1c/0x28\n  mutex_lock+0x50/0x74\n  clk_prepare_lock+0x7c/0x9c\n  clk_core_prepare_lock+0x20/0x44\n  clk_prepare+0x24/0x30\n  clk_bulk_prepare+0x40/0xb0\n  mdss_runtime_resume+0x54/0x1c8\n  pm_generic_runtime_resume+0x30/0x44\n  __genpd_runtime_resume+0x68/0x7c\n  genpd_runtime_resume+0x108/0x1f4\n  __rpm_callback+0x84/0x144\n  rpm_callback+0x30/0x88\n  rpm_resume+0x1f4/0x52c\n  rpm_resume+0x178/0x52c\n  __pm_runtime_resume+0x58/0x98\n  __device_attach+0xe0/0x170\n  device_initial_probe+0x1c/0x28\n  bus_probe_device+0x3c/0x9c\n  device_add+0x644/0x814\n  mipi_dsi_device_register_full+0xe4/0x170\n  devm_mipi_dsi_device_register_full+0x28/0x70\n  ti_sn_bridge_probe+0x1dc/0x2c0\n  auxiliary_bus_probe+0x4c/0x94\n  really_probe+0xcc/0x2c8\n  __driver_probe_device+0xa8/0x130\n  driver_probe_device+0x48/0x110\n  __device_attach_driver+0xa4/0xcc\n  bus_for_each_drv+0x8c/0xd8\n  __device_attach+0xf8/0x170\n  device_initial_probe+0x1c/0x28\n  bus_probe_device+0x3c/0x9c\n  deferred_probe_work_func+0x9c/0xd8\n  process_one_work+0x148/0x518\n  worker_thread+0x138/0x350\n  kthread+0x138/0x1e0\n  ret_from_fork+0x10/0x20\n\nThe first thread is walking the clk tree and calling\nclk_pm_runtime_get() to power on devices required to read the clk\nhardware via struct clk_ops::is_enabled(). This thread holds the clk\nprepare_lock, and is trying to runtime PM resume a device, when it finds\nthat the device is in the process of resuming so the thread schedule()s\naway waiting for the device to finish resuming before continuing. The\nsecond thread is runtime PM resuming the same device, but the runtime\nresume callback is calling clk_prepare(), trying to grab the\nprepare_lock waiting on the first thread.\n\nThis is a classic ABBA deadlock. To properly fix the deadlock, we must\nnever runtime PM resume or suspend a device with the clk prepare_lock\nheld. Actually doing that is near impossible today because the global\nprepare_lock would have to be dropped in the middle of the tree, the\ndevice runtime PM resumed/suspended, and then the prepare_lock grabbed\nagain to ensure consistency of the clk tree topology. If anything\nchanges with the clk tree in the meantime, we\u0026apos;ve lost and will need to\nstart the operation all over again.\n\nLuckily, most of the time we\u0026apos;re simply incrementing or decrementing the\nruntime PM count on an active device, so we don\u0026apos;t have the chance to\nschedule away with the prepare_lock held. Let\u0026apos;s fix this immediate\nproblem that can be\n---truncated---(CVE-2024-27004)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: bridge: add owner module and take its refcount\n\nThe current implementation of the fpga bridge assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module\u0026apos;s refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the bridge if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_bridge\nstruct and use it to take the module\u0026apos;s refcount. Modify the function for\nregistering a bridge to take an additional owner module parameter and\nrename it to avoid conflicts. Use the old function name for a helper macro\nthat automatically sets the module that registers the bridge as the owner.\nThis ensures compatibility with existing low-level control modules and\nreduces the chances of registering a bridge without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga bridge.\n\nOther changes: opportunistically move put_device() from __fpga_bridge_get()\nto fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since\nthe bridge device is taken in these functions.(CVE-2024-36479)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: manager: add owner module and take its refcount\n\nThe current implementation of the fpga manager assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module\u0026apos;s refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the manager if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_manager\nstruct and use it to take the module\u0026apos;s refcount. Modify the functions for\nregistering the manager to take an additional owner module parameter and\nrename them to avoid conflicts. Use the old function names for helper\nmacros that automatically set the module that registers the manager as the\nowner. This ensures compatibility with existing low-level control modules\nand reduces the chances of registering a manager without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga manager.\n\nOther changes: opportunistically move put_device() from __fpga_mgr_get() to\nfpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the\nmanager device is taken in these functions.(CVE-2024-37021)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni2c: lpi2c: Avoid calling clk_get_rate during transfer\n\nInstead of repeatedly calling clk_get_rate for each transfer, lock\nthe clock rate and cache the value.\nA deadlock has been observed while adding tlv320aic32x4 audio codec to\nthe system. When this clock provider adds its clock, the clk mutex is\nlocked already, it needs to access i2c, which in return needs the mutex\nfor clk_get_rate as well.(CVE-2024-40965)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: probes: Fix uprobes for big-endian kernels\n\nThe arm64 uprobes code is broken for big-endian kernels as it doesn\u0026apos;t\nconvert the in-memory instruction encoding (which is always\nlittle-endian) into the kernel\u0026apos;s native endianness before analyzing and\nsimulating instructions. This may result in a few distinct problems:\n\n* The kernel may may erroneously reject probing an instruction which can\n  safely be probed.\n\n* The kernel may erroneously erroneously permit stepping an\n  instruction out-of-line when that instruction cannot be stepped\n  out-of-line safely.\n\n* The kernel may erroneously simulate instruction incorrectly dur to\n  interpretting the byte-swapped encoding.\n\nThe endianness mismatch isn\u0026apos;t caught by the compiler or sparse because:\n\n* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so\n  the compiler and sparse have no idea these contain a little-endian\n  32-bit value. The core uprobes code populates these with a memcpy()\n  which similarly does not handle endianness.\n\n* While the uprobe_opcode_t type is an alias for __le32, both\n  arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[]\n  to the similarly-named probe_opcode_t, which is an alias for u32.\n  Hence there is no endianness conversion warning.\n\nFix this by changing the arch_uprobe::{insn,ixol} fields to __le32 and\nadding the appropriate __le32_to_cpu() conversions prior to consuming\nthe instruction encoding. The core uprobes copies these fields as opaque\nranges of bytes, and so is unaffected by this change.\n\nAt the same time, remove MAX_UINSN_BYTES and consistently use\nAARCH64_INSN_SIZE for clarity.\n\nTested with the following:\n\n| #include \u0026lt;stdio.h\u0026gt;\n| #include \u0026lt;stdbool.h\u0026gt;\n|\n| #define noinline __attribute__((noinline))\n|\n| static noinline void *adrp_self(void)\n| {\n|         void *addr;\n|\n|         asm volatile(\n|         \u0026quot;       adrp    %x0, adrp_self\\n\u0026quot;\n|         \u0026quot;       add     %x0, %x0, :lo12:adrp_self\\n\u0026quot;\n|         : \u0026quot;=r\u0026quot; (addr));\n| }\n|\n|\n| int main(int argc, char *argv)\n| {\n|         void *ptr = adrp_self();\n|         bool equal = (ptr == adrp_self);\n|\n|         printf(\u0026quot;adrp_self   =\u0026gt; %p\\n\u0026quot;\n|                \u0026quot;adrp_self() =\u0026gt; %p\\n\u0026quot;\n|                \u0026quot;%s\\n\u0026quot;,\n|                adrp_self, ptr, equal ? \u0026quot;EQUAL\u0026quot; : \u0026quot;NOT EQUAL\u0026quot;);\n|\n|         return 0;\n| }\n\n.... where the adrp_self() function was compiled to:\n\n| 00000000004007e0 \u0026lt;adrp_self\u0026gt;:\n|   4007e0:       90000000        adrp    x0, 400000 \u0026lt;__ehdr_start\u0026gt;\n|   4007e4:       911f8000        add     x0, x0, #0x7e0\n|   4007e8:       d65f03c0        ret\n\nBefore this patch, the ADRP is not recognized, and is assumed to be\nsteppable, resulting in corruption of the result:\n\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0x4007e0\n| EQUAL\n| # echo \u0026apos;p /root/adrp-self:0x007e0\u0026apos; \u0026gt; /sys/kernel/tracing/uprobe_events\n| # echo 1 \u0026gt; /sys/kernel/tracing/events/uprobes/enable\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0xffffffffff7e0\n| NOT EQUAL\n\nAfter this patch, the ADRP is correctly recognized and simulated:\n\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0x4007e0\n| EQUAL\n| #\n| # echo \u0026apos;p /root/adrp-self:0x007e0\u0026apos; \u0026gt; /sys/kernel/tracing/uprobe_events\n| # echo 1 \u0026gt; /sys/kernel/tracing/events/uprobes/enable\n| # ./adrp-self\n| adrp_self   =\u0026gt; 0x4007e0\n| adrp_self() =\u0026gt; 0x4007e0\n| EQUAL(CVE-2024-50194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix flushing uninitialized delayed_work on cache_ctr error\n\nAn unexpected WARN_ON from flush_work() may occur when cache creation\nfails, caused by destroying the uninitialized delayed_work waker in the\nerror path of cache_create(). For example, the warning appears on the\nsuperblock checksum error.\n\nReproduce steps:\n\ndmsetup create cmeta --table \u0026quot;0 8192 linear /dev/sdc 0\u0026quot;\ndmsetup create cdata --table \u0026quot;0 65536 linear /dev/sdc 8192\u0026quot;\ndmsetup create corig --table \u0026quot;0 524288 linear /dev/sdc 262144\u0026quot;\ndd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \u0026quot;0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\u0026quot;\n\nKernel logs:\n\n(snip)\nWARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890\n\nFix by pulling out the cancel_delayed_work_sync() from the constructor\u0026apos;s\nerror path. This patch doesn\u0026apos;t affect the use-after-free fix for\nconcurrent dm_resume and dm_destroy (commit 6a459d8edbdb (\u0026quot;dm cache: Fix\nUAF in destroy()\u0026quot;)) as cache_dtr is not changed.(CVE-2024-50280)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix null-ptr-deref in block_touch_buffer tracepoint\n\nPatch series \u0026quot;nilfs2: fix null-ptr-deref bugs on block tracepoints\u0026quot;.\n\nThis series fixes null pointer dereference bugs that occur when using\nnilfs2 and two block-related tracepoints.\n\n\nThis patch (of 2):\n\nIt has been reported that when using \u0026quot;block:block_touch_buffer\u0026quot;\ntracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a\nNULL pointer dereference, or a general protection fault when KASAN is\nenabled.\n\nThis happens because since the tracepoint was added in touch_buffer(), it\nreferences the dev_t member bh-\u0026gt;b_bdev-\u0026gt;bd_dev regardless of whether the\nbuffer head has a pointer to a block_device structure.  In the current\nimplementation, the block_device structure is set after the function\nreturns to the caller.\n\nHere, touch_buffer() is used to mark the folio/page that owns the buffer\nhead as accessed, but the common search helper for folio/page used by the\ncaller function was optimized to mark the folio/page as accessed when it\nwas reimplemented a long time ago, eliminating the need to call\ntouch_buffer() here in the first place.\n\nSo this solves the issue by eliminating the touch_buffer() call itself.(CVE-2024-53131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: net: Do not use drvdata in release\n\nThe drvdata is not available in release. Let\u0026apos;s just use container_of()\nto get the uml_net instance. Otherwise, removing a network device will\nresult in a crash:\n\nRIP: 0033:net_device_release+0x10/0x6f\nRSP: 00000000e20c7c40  EFLAGS: 00010206\nRAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0\nRDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028\nRBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70\nR10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000\nR13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1\nWorkqueue: events mc_work_proc\nStack:\n 627af028 62c7af00 e20c7c80 60276fcd\n 62778000 603f5820 627af028 00000000\n e20c7cb0 603a2bcd 627af000 62770010\nCall Trace:\n [\u0026lt;60276fcd\u0026gt;] device_release+0x70/0xba\n [\u0026lt;603a2bcd\u0026gt;] kobject_put+0xba/0xe7\n [\u0026lt;60277265\u0026gt;] put_device+0x19/0x1c\n [\u0026lt;60281266\u0026gt;] platform_device_put+0x26/0x29\n [\u0026lt;60281e5f\u0026gt;] platform_device_unregister+0x2c/0x2e\n [\u0026lt;6002ec9c\u0026gt;] net_remove+0x63/0x69\n [\u0026lt;60031316\u0026gt;] ? mconsole_reply+0x0/0x50\n [\u0026lt;600310c8\u0026gt;] mconsole_remove+0x160/0x1cc\n [\u0026lt;60087d40\u0026gt;] ? __remove_hrtimer+0x38/0x74\n [\u0026lt;60087ff8\u0026gt;] ? hrtimer_try_to_cancel+0x8c/0x98\n [\u0026lt;6006b3cf\u0026gt;] ? dl_server_stop+0x3f/0x48\n [\u0026lt;6006b390\u0026gt;] ? dl_server_stop+0x0/0x48\n [\u0026lt;600672e8\u0026gt;] ? dequeue_entities+0x327/0x390\n [\u0026lt;60038fa6\u0026gt;] ? um_set_signals+0x0/0x43\n [\u0026lt;6003070c\u0026gt;] mc_work_proc+0x77/0x91\n [\u0026lt;60057664\u0026gt;] process_scheduled_works+0x1b3/0x2dd\n [\u0026lt;60055f32\u0026gt;] ? assign_work+0x0/0x58\n [\u0026lt;60057f0a\u0026gt;] worker_thread+0x1e9/0x293\n [\u0026lt;6005406f\u0026gt;] ? set_pf_worker+0x0/0x64\n [\u0026lt;6005d65d\u0026gt;] ? arch_local_irq_save+0x0/0x2d\n [\u0026lt;6005d748\u0026gt;] ? kthread_exit+0x0/0x3a\n [\u0026lt;60057d21\u0026gt;] ? worker_thread+0x0/0x293\n [\u0026lt;6005dbf1\u0026gt;] kthread+0x126/0x12b\n [\u0026lt;600219c5\u0026gt;] new_thread_handler+0x85/0xb6(CVE-2024-53183)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen: Fix the issue of resource not being properly released in xenbus_dev_probe()\n\nThis patch fixes an issue in the function xenbus_dev_probe(). In the\nxenbus_dev_probe() function, within the if (err) branch at line 313, the\nprogram incorrectly returns err directly without releasing the resources\nallocated by err = drv-\u0026gt;probe(dev, id). As the return value is non-zero,\nthe upper layers assume the processing logic has failed. However, the probe\noperation was performed earlier without a corresponding remove operation.\nSince the probe actually allocates resources, failing to perform the remove\noperation could lead to problems.\n\nTo fix this issue, we followed the resource release logic of the\nxenbus_dev_remove() function by adding a new block fail_remove before the\nfail_put block. After entering the branch if (err) at line 313, the\nfunction will use a goto statement to jump to the fail_remove block,\nensuring that the previously acquired resources are correctly released,\nthus preventing the reference count leak.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch.(CVE-2024-53198)\n\nIn the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipeThis commit addresses a null pointer dereference issue indcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ( drm/amd/display:Add null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipe )partially fixed the null pointer dereference issue. However, indcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, andplane_state is accessed again through pipe_ctx. Multiple if statementsdirectly call attributes of plane_state, leading to potential nullpointer dereference issues. This patch adds necessary null checks toensure stability.(CVE-2024-53201)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()\n\nReplace one-element array with a flexible-array member in `struct\nmwifiex_ie_types_wildcard_ssid_params` to fix the following warning\non a MT8173 Chromebook (mt8173-elm-hana):\n\n[  356.775250] ------------[ cut here ]------------\n[  356.784543] memcpy: detected field-spanning write (size 6) of single field \u0026quot;wildcard_ssid_tlv-\u0026gt;ssid\u0026quot; at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1)\n[  356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]\n\nThe \u0026quot;(size 6)\u0026quot; above is exactly the length of the SSID of the network\nthis device was connected to. The source of the warning looks like:\n\n    ssid_len = user_scan_in-\u0026gt;ssid_list[i].ssid_len;\n    [...]\n    memcpy(wildcard_ssid_tlv-\u0026gt;ssid,\n           user_scan_in-\u0026gt;ssid_list[i].ssid, ssid_len);\n\nThere is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this\nstruct, but it already didn\u0026apos;t account for the size of the one-element\narray, so it doesn\u0026apos;t need to be changed.(CVE-2024-56539)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Require entities to have a non-zero unique ID\n\nPer UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero\nunique ID.\n\n```\nEach Unit and Terminal within the video function is assigned a unique\nidentification number, the Unit ID (UID) or Terminal ID (TID), contained in\nthe bUnitID or bTerminalID field of the descriptor. The value 0x00 is\nreserved for undefined ID,\n```\n\nSo, deny allocating an entity with ID 0 or an ID that belongs to a unit\nthat is already added to the list of entities.\n\nThis also prevents some syzkaller reproducers from triggering warnings due\nto a chain of entities referring to themselves. In one particular case, an\nOutput Unit is connected to an Input Unit, both with the same ID of 1. But\nwhen looking up for the source ID of the Output Unit, that same entity is\nfound instead of the input entity, which leads to such warnings.\n\nIn another case, a backward chain was considered finished as the source ID\nwas 0. Later on, that entity was found, but its pads were not valid.\n\nHere is a sample stack trace for one of those cases.\n\n[   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd\n[   20.830206] usb 1-1: Using ep0 maxpacket: 8\n[   20.833501] usb 1-1: config 0 descriptor??\n[   21.038518] usb 1-1: string descriptor 0 read error: -71\n[   21.038893] usb 1-1: Found UVC 0.00 device \u0026lt;unnamed\u0026gt; (2833:0201)\n[   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!\n[   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!\n[   21.042218] ------------[ cut here ]------------\n[   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0\n[   21.043195] Modules linked in:\n[   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444\n[   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[   21.044639] Workqueue: usb_hub_wq hub_event\n[   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0\n[   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 \u0026lt;0f\u0026gt; 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00\n[   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246\n[   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1\n[   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290\n[   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000\n[   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003\n[   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000\n[   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000\n[   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0\n[   21.051136] PKRU: 55555554\n[   21.051331] Call Trace:\n[   21.051480]  \u0026lt;TASK\u0026gt;\n[   21.051611]  ? __warn+0xc4/0x210\n[   21.051861]  ? media_create_pad_link+0x2c4/0x2e0\n[   21.052252]  ? report_bug+0x11b/0x1a0\n[   21.052540]  ? trace_hardirqs_on+0x31/0x40\n[   21.052901]  ? handle_bug+0x3d/0x70\n[   21.053197]  ? exc_invalid_op+0x1a/0x50\n[   21.053511]  ? asm_exc_invalid_op+0x1a/0x20\n[   21.053924]  ? media_create_pad_link+0x91/0x2e0\n[   21.054364]  ? media_create_pad_link+0x2c4/0x2e0\n[   21.054834]  ? media_create_pad_link+0x91/0x2e0\n[   21.055131]  ? _raw_spin_unlock+0x1e/0x40\n[   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210\n[   21.055837]  uvc_mc_register_entities+0x358/0x400\n[   21.056144]  uvc_register_chains+0x1fd/0x290\n[   21.056413]  uvc_probe+0x380e/0x3dc0\n[   21.056676]  ? __lock_acquire+0x5aa/0x26e0\n[   21.056946]  ? find_held_lock+0x33/0xa0\n[   21.057196]  ? kernfs_activate+0x70/0x80\n[   21.057533]  ? usb_match_dy\n---truncated---(CVE-2024-56571)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Create all dump files during debugfs initialization\n\nFor the current debugfs of hisi_sas, after user triggers dump, the\ndriver allocate memory space to save the register information and create\ndebugfs files to display the saved information. In this process, the\ndebugfs files created after each dump.\n\nTherefore, when the dump is triggered while the driver is unbind, the\nfollowing hang occurs:\n\n[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0\n[67840.862947] Mem abort info:\n[67840.865855]   ESR = 0x0000000096000004\n[67840.869713]   EC = 0x25: DABT (current EL), IL = 32 bits\n[67840.875125]   SET = 0, FnV = 0\n[67840.878291]   EA = 0, S1PTW = 0\n[67840.881545]   FSC = 0x04: level 0 translation fault\n[67840.886528] Data abort info:\n[67840.889524]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[67840.895117]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[67840.900284]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000\n[67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000\n[67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[67841.003628] pc : down_write+0x30/0x98\n[67841.007546] lr : start_creating.part.0+0x60/0x198\n[67841.012495] sp : ffff8000b979ba20\n[67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40\n[67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8\n[67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18\n[67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020\n[67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff\n[67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18\n[67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18\n[67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9\n[67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001\n[67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0\n[67841.089759] Call trace:\n[67841.092456]  down_write+0x30/0x98\n[67841.096017]  start_creating.part.0+0x60/0x198\n[67841.100613]  debugfs_create_dir+0x48/0x1f8\n[67841.104950]  debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw]\n[67841.111447]  debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw]\n[67841.118111]  debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw]\n[67841.125115]  full_proxy_write+0x68/0xc8\n[67841.129175]  vfs_write+0xd8/0x3f0\n[67841.132708]  ksys_write+0x70/0x108\n[67841.136317]  __arm64_sys_write+0x24/0x38\n[67841.140440]  invoke_syscall+0x50/0x128\n[67841.144385]  el0_svc_common.constprop.0+0xc8/0xf0\n[67841.149273]  do_el0_svc+0x24/0x38\n[67841.152773]  el0_svc+0x38/0xd8\n[67841.156009]  el0t_64_sync_handler+0xc0/0xc8\n[67841.160361]  el0t_64_sync+0x1a4/0x1a8\n[67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05)\n[67841.170443] ---[ end trace 0000000000000000 ]---\n\nTo fix this issue, create all directories and files during debugfs\ninitialization. In this way, the driver only needs to allocate memory\nspace to save information each time the user triggers dumping.(CVE-2024-56588)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nkcsan: Turn report_filterlist_lock into a raw_spinlock\n\nRan Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see\nsplats like:\n\n| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n| in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1\n| preempt_count: 10002, expected: 0\n| RCU nest depth: 0, expected: 0\n| no locks held by swapper/1/0.\n| irq event stamp: 156674\n| hardirqs last  enabled at (156673): [\u0026lt;ffffffff81130bd9\u0026gt;] do_idle+0x1f9/0x240\n| hardirqs last disabled at (156674): [\u0026lt;ffffffff82254f84\u0026gt;] sysvec_apic_timer_interrupt+0x14/0xc0\n| softirqs last  enabled at (0): [\u0026lt;ffffffff81099f47\u0026gt;] copy_process+0xfc7/0x4b60\n| softirqs last disabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n| Preemption disabled at:\n| [\u0026lt;ffffffff814a3e2a\u0026gt;] paint_ptr+0x2a/0x90\n| CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.11.0+ #3\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014\n| Call Trace:\n|  \u0026lt;IRQ\u0026gt;\n|  dump_stack_lvl+0x7e/0xc0\n|  dump_stack+0x1d/0x30\n|  __might_resched+0x1a2/0x270\n|  rt_spin_lock+0x68/0x170\n|  kcsan_skip_report_debugfs+0x43/0xe0\n|  print_report+0xb5/0x590\n|  kcsan_report_known_origin+0x1b1/0x1d0\n|  kcsan_setup_watchpoint+0x348/0x650\n|  __tsan_unaligned_write1+0x16d/0x1d0\n|  hrtimer_interrupt+0x3d6/0x430\n|  __sysvec_apic_timer_interrupt+0xe8/0x3a0\n|  sysvec_apic_timer_interrupt+0x97/0xc0\n|  \u0026lt;/IRQ\u0026gt;\n\nOn a detected data race, KCSAN\u0026apos;s reporting logic checks if it should\nfilter the report. That list is protected by the report_filterlist_lock\n*non-raw* spinlock which may sleep on RT kernels.\n\nSince KCSAN may report data races in any context, convert it to a\nraw_spinlock.\n\nThis requires being careful about when to allocate memory for the filter\nlist itself which can be done via KCSAN\u0026apos;s debugfs interface. Concurrent\nmodification of the filter list via debugfs should be rare: the chosen\nstrategy is to optimistically pre-allocate memory before the critical\nsection and discard if unused.(CVE-2024-56610)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM\n\nWe currently assume that there is at least one VMA in a MM, which isn\u0026apos;t\ntrue.\n\nSo we might end up having find_vma() return NULL, to then de-reference\nNULL.  So properly handle find_vma() returning NULL.\n\nThis fixes the report:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nRIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]\nRIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194\nCode: ...\nRSP: 0018:ffffc9000375fd08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000\nRDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044\nRBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1\nR10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003\nR13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8\nFS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709\n __do_sys_migrate_pages mm/mempolicy.c:1727 [inline]\n __se_sys_migrate_pages mm/mempolicy.c:1723 [inline]\n __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[akpm@linux-foundation.org: add unlikely()](CVE-2024-56611)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use after free on unload\n\nSystem crash is observed with stack trace warning of use after\nfree. There are 2 signals to tell dpc_thread to terminate (UNLOADING\nflag and kthread_stop).\n\nOn setting the UNLOADING flag when dpc_thread happens to run at the time\nand sees the flag, this causes dpc_thread to exit and clean up\nitself. When kthread_stop is called for final cleanup, this causes use\nafter free.\n\nRemove UNLOADING signal to terminate dpc_thread.  Use the kthread_stop\nas the main signal to exit dpc_thread.\n\n[596663.812935] kernel BUG at mm/slub.c:294!\n[596663.812950] invalid opcode: 0000 [#1] SMP PTI\n[596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-240.el8.x86_64 #1\n[596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012\n[596663.812974] RIP: 0010:__slab_free+0x17d/0x360\n\n...\n[596663.813008] Call Trace:\n[596663.813022]  ? __dentry_kill+0x121/0x170\n[596663.813030]  ? _cond_resched+0x15/0x30\n[596663.813034]  ? _cond_resched+0x15/0x30\n[596663.813039]  ? wait_for_completion+0x35/0x190\n[596663.813048]  ? try_to_wake_up+0x63/0x540\n[596663.813055]  free_task+0x5a/0x60\n[596663.813061]  kthread_stop+0xf3/0x100\n[596663.813103]  qla2x00_remove_one+0x284/0x440 [qla2xxx](CVE-2024-56623)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport\n\nSince transport-\u0026gt;sock has been set to NULL during reset transport,\nXPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the\nxs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request()\nto dereference the transport-\u0026gt;sock that has been set to NULL.(CVE-2024-56688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\n9p/xen: fix release of IRQ\n\nKernel logs indicate an IRQ was double-freed.\n\nPass correct device ID during IRQ release.\n\n[Dominique: remove confusing variable reset to 0](CVE-2024-56704)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nionic: Fix netdev notifier unregister on failure\n\nIf register_netdev() fails, then the driver leaks the netdev notifier.\nFix this by calling ionic_lif_unregister() on register_netdev()\nfailure. This will also call ionic_lif_unregister_phc() if it has\nalready been registered.(CVE-2024-56715)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()\n\nWhen information such as info-\u0026gt;screen_base is not ready, calling\nsh7760fb_free_mem() does not release memory correctly. Call\ndma_free_coherent() instead.(CVE-2024-56746)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\n\nWhen mounting ocfs2 and then remounting it as read-only, a\nslab-use-after-free occurs after the user uses a syscall to\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u0026gt;dqi_priv is the\ndangling pointer.\n\nDuring the remounting process, the pointer dqi_priv is freed but is never\nset as null leaving it to be accessed.  Additionally, the read-only option\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\nnext quota, the function ocfs2_get_next_id is called and only checks the\nquota usage flags and not the quota suspended flags.\n\nTo fix this, I set dqi_priv to null when it is freed after remounting with\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\n\n[akpm@linux-foundation.org: coding-style cleanups](CVE-2024-57892)","status":"published","published":"2025-02-08T11:08:11Z","modified":"2026-08-18T01:18:46.994904196Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1097","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial out-of-bounds when buffer offset is invalid\n\nI found potencial out-of-bounds when buffer offset fields of a few requests\nis invalid. This patch set the minimum value of buffer offset field to\n-\u0026gt;Buffer offset to validate buffer length.(CVE-2024-26952)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()\n\nIf -\u0026gt;NameOffset of smb2_create_req is smaller than Buffer offset of\nsmb2_create_req, slab-out-of-bounds read can happen from smb2_open.\nThis patch set the minimum value of the name offset to the buffer offset\nto validate name length of smb2_create_req().(CVE-2024-26954)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: bridge: add owner module and take its refcount\n\nThe current implementation of the fpga bridge assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module\u0026apos;s refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the bridge if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_bridge\nstruct and use it to take the module\u0026apos;s refcount. Modify the function for\nregistering a bridge to take an additional owner module parameter and\nrename it to avoid conflicts. Use the old function name for a helper macro\nthat automatically sets the module that registers the bridge as the owner.\nThis ensures compatibility with existing low-level control modules and\nreduces the chances of registering a bridge without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga bridge.\n\nOther changes: opportunistically move put_device() from __fpga_bridge_get()\nto fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since\nthe bridge device is taken in these functions.(CVE-2024-36479)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-iocost: avoid out of bounds shift\n\nUBSAN catches undefined behavior in blk-iocost, where sometimes\niocg-\u0026gt;delay is shifted right by a number that is too large,\nresulting in undefined behavior on some architectures.\n\n[  186.556576] ------------[ cut here ]------------\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23\nshift exponent 64 is too large for 64-bit type \u0026apos;u64\u0026apos; (aka \u0026apos;unsigned long long\u0026apos;)\nCPU: 16 PID: 0 Comm: swapper/16 Tainted: G S          E    N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1\nHardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n dump_stack_lvl+0x8f/0xe0\n __ubsan_handle_shift_out_of_bounds+0x22c/0x280\n iocg_kick_delay+0x30b/0x310\n ioc_timer_fn+0x2fb/0x1f80\n __run_timer_base+0x1b6/0x250\n...\n\nAvoid that undefined behavior by simply taking the\n\u0026quot;delay = 0\u0026quot; branch if the shift is too large.\n\nI am not sure what the symptoms of an undefined value\ndelay will be, but I suspect it could be more than a\nlittle annoying to debug.(CVE-2024-36916)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: manager: add owner module and take its refcount\n\nThe current implementation of the fpga manager assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module\u0026apos;s refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the manager if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_manager\nstruct and use it to take the module\u0026apos;s refcount. Modify the functions for\nregistering the manager to take an additional owner module parameter and\nrename them to avoid conflicts. Use the old function names for helper\nmacros that automatically set the module that registers the manager as the\nowner. This ensures compatibility with existing low-level control modules\nand reduces the chances of registering a manager without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga manager.\n\nOther changes: opportunistically move put_device() from __fpga_mgr_get() to\nfpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the\nmanager device is taken in these functions.(CVE-2024-37021)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/tsens: Fix null pointer dereference\n\ncompute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c)\nas compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null\npointer dereference (if DEBUG or DYNAMIC_DEBUG set).\nFix this bug by adding null pointer check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-38571)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: pcie: handle randbuf allocation failure\n\nThe kzalloc() in brcmf_pcie_download_fw_nvram() will return null\nif the physical memory has run out. As a result, if we use\nget_random_bytes() to generate random bytes in the randbuf, the\nnull pointer dereference bug will happen.\n\nIn order to prevent allocation failure, this patch adds a separate\nfunction using buffer on kernel stack to generate random bytes in\nthe randbuf, which could prevent the kernel stack from overflow.(CVE-2024-38575)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntools/nolibc/stdlib: fix memory error in realloc()\n\nPass user_p_len to memcpy() instead of heap-\u0026gt;len to prevent realloc()\nfrom copying an extra sizeof(heap) bytes from beyond the allocated\nregion.(CVE-2024-38585)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stk1160: fix bounds checking in stk1160_copy_video()\n\nThe subtract in this condition is reversed.  The -\u0026gt;length is the length\nof the buffer.  The -\u0026gt;bytesused is how many bytes we have copied thus\nfar.  When the condition is reversed that means the result of the\nsubtraction is always negative but since it\u0026apos;s unsigned then the result\nis a very high positive value.  That means the overflow check is never\ntrue.\n\nAdditionally, the -\u0026gt;bytesused doesn\u0026apos;t actually work for this purpose\nbecause we\u0026apos;re not writing to \u0026quot;buf-\u0026gt;mem + buf-\u0026gt;bytesused\u0026quot;.  Instead, the\nmath to calculate the destination where we are writing is a bit\ninvolved.  You calculate the number of full lines already written,\nmultiply by two, skip a line if necessary so that we start on an odd\nnumbered line, and add the offset into the line.\n\nTo fix this buffer overflow, just take the actual destination where we\nare writing, if the offset is already out of bounds print an error and\nreturn.  Otherwise, write up to buf-\u0026gt;length bytes.(CVE-2024-38621)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\n\ncommit a421ef303008 (\u0026quot;mm: allow !GFP_KERNEL allocations for kvmalloc\u0026quot;)\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\ndd544141b9eb (\u0026quot;vmalloc: back off when the current task is OOM-killed\u0026quot;).  A\npossible scenario is as follows:\n\nprocess-a\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\n    __vmalloc_area_node()\n        vm_area_alloc_pages()\n\t\t--\u0026gt; oom-killer send SIGKILL to process-a\n        if (fatal_signal_pending(current)) break;\n--\u0026gt; return NULL;\n\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\nif __GFP_NOFAIL set.\n\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\n-\u0026gt; oom-killer sends signal to process\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\n\n[65731.259685] [T32454] Call trace:\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\n[65731.259734] [T32454]  show_stack+0x18/0x24\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\n[65731.259781] [T32454]  dump_stack+0x18/0x38\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\n[65731.260047] [T32454]  notify_die+0x114/0x198\n[65731.260073] [T32454]  die+0xf4/0x5b4\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\n\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\n--\u0026gt; be-\u0026gt;decompressed_pages = kvcalloc(be-\u0026gt;nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\n\tkernel panic by NULL pointer dereference.\n\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\n[65731.260339] [T32454]  read_pages+0x170/0xadc\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\n[65731.260509] [T32454]  el0_da+0x44/0x94\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c(CVE-2024-39474)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix variable length array abuse in btree_iter\n\nbtree_iter is used in two ways: either allocated on the stack with a\nfixed size MAX_BSETS, or from a mempool with a dynamic size based on the\nspecific cache set. Previously, the struct had a fixed-length array of\nsize MAX_BSETS which was indexed out-of-bounds for the dynamically-sized\niterators, which causes UBSAN to complain.\n\nThis patch uses the same approach as in bcachefs\u0026apos;s sort_iter and splits\nthe iterator into a btree_iter with a flexible array member and a\nbtree_iter_stack which embeds a btree_iter as well as a fixed-length\ndata array.(CVE-2024-39482)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: Fix use-after-free bug in gb_interface_release due to race condition.\n\nIn gb_interface_create, \u0026amp;intf-\u0026gt;mode_switch_completion is bound with\ngb_interface_mode_switch_work. Then it will be started by\ngb_interface_request_mode_switch. Here is the relevant code.\nif (!queue_work(system_long_wq, \u0026amp;intf-\u0026gt;mode_switch_work)) {\n\t...\n}\n\nIf we call gb_interface_release to make cleanup, there may be an\nunfinished work. This function will call kfree to free the object\n\u0026quot;intf\u0026quot;. However, if gb_interface_mode_switch_work is scheduled to\nrun after kfree, it may cause use-after-free error as\ngb_interface_mode_switch_work will use the object \u0026quot;intf\u0026quot;.\nThe possible execution flow that may lead to the issue is as follows:\n\nCPU0                            CPU1\n\n                            |   gb_interface_create\n                            |   gb_interface_request_mode_switch\ngb_interface_release        |\nkfree(intf) (free)          |\n                            |   gb_interface_mode_switch_work\n                            |   mutex_lock(\u0026amp;intf-\u0026gt;mutex) (use)\n\nFix it by canceling the work before kfree.(CVE-2024-39495)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dpt: Make DPT object unshrinkable\n\nIn some scenarios, the DPT object gets shrunk but\nthe actual framebuffer did not and thus its still\nthere on the DPT\u0026apos;s vm-\u0026gt;bound_list. Then it tries to\nrewrite the PTEs via a stale CPU mapping. This causes panic.\n\n[vsyrjala: Add TODO comment]\n(cherry picked from commit 51064d471c53dcc8eddd2333c3f1c1d9131ba36c)(CVE-2024-40924)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: Clear napi-\u0026gt;skb before dev_kfree_skb_any()\n\ngve_rx_free_skb incorrectly leaves napi-\u0026gt;skb referencing an skb after it\nis freed with dev_kfree_skb_any(). This can result in a subsequent call\nto napi_get_frags returning a dangling pointer.\n\nFix this by clearing napi-\u0026gt;skb before the skb is freed.(CVE-2024-40937)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: shmem: fix getting incorrect lruvec when replacing a shmem folio\n\nWhen testing shmem swapin, I encountered the warning below on my machine. \nThe reason is that replacing an old shmem folio with a new one causes\nmem_cgroup_migrate() to clear the old folio\u0026apos;s memcg data.  As a result,\nthe old folio cannot get the correct memcg\u0026apos;s lruvec needed to remove\nitself from the LRU list when it is being freed.  This could lead to\npossible serious problems, such as LRU list crashes due to holding the\nwrong LRU lock, and incorrect LRU statistics.\n\nTo fix this issue, we can fallback to use the mem_cgroup_replace_folio()\nto replace the old shmem folio.\n\n[ 5241.100311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5d9960\n[ 5241.100317] head: order:4 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 5241.100319] flags: 0x17fffe0000040068(uptodate|lru|head|swapbacked|node=0|zone=2|lastcpupid=0x3ffff)\n[ 5241.100323] raw: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000\n[ 5241.100325] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n[ 5241.100326] head: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000\n[ 5241.100327] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n[ 5241.100328] head: 17fffe0000000204 fffffdffd6665801 ffffffffffffffff 0000000000000000\n[ 5241.100329] head: 0000000a00000010 0000000000000000 00000000ffffffff 0000000000000000\n[ 5241.100330] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg \u0026amp;\u0026amp; !mem_cgroup_disabled())\n[ 5241.100338] ------------[ cut here ]------------\n[ 5241.100339] WARNING: CPU: 19 PID: 78402 at include/linux/memcontrol.h:775 folio_lruvec_lock_irqsave+0x140/0x150\n[...]\n[ 5241.100374] pc : folio_lruvec_lock_irqsave+0x140/0x150\n[ 5241.100375] lr : folio_lruvec_lock_irqsave+0x138/0x150\n[ 5241.100376] sp : ffff80008b38b930\n[...]\n[ 5241.100398] Call trace:\n[ 5241.100399]  folio_lruvec_lock_irqsave+0x140/0x150\n[ 5241.100401]  __page_cache_release+0x90/0x300\n[ 5241.100404]  __folio_put+0x50/0x108\n[ 5241.100406]  shmem_replace_folio+0x1b4/0x240\n[ 5241.100409]  shmem_swapin_folio+0x314/0x528\n[ 5241.100411]  shmem_get_folio_gfp+0x3b4/0x930\n[ 5241.100412]  shmem_fault+0x74/0x160\n[ 5241.100414]  __do_fault+0x40/0x218\n[ 5241.100417]  do_shared_fault+0x34/0x1b0\n[ 5241.100419]  do_fault+0x40/0x168\n[ 5241.100420]  handle_pte_fault+0x80/0x228\n[ 5241.100422]  __handle_mm_fault+0x1c4/0x440\n[ 5241.100424]  handle_mm_fault+0x60/0x1f0\n[ 5241.100426]  do_page_fault+0x120/0x488\n[ 5241.100429]  do_translation_fault+0x4c/0x68\n[ 5241.100431]  do_mem_abort+0x48/0xa0\n[ 5241.100434]  el0_da+0x38/0xc0\n[ 5241.100436]  el0t_64_sync_handler+0x68/0xc0\n[ 5241.100437]  el0t_64_sync+0x14c/0x150\n[ 5241.100439] ---[ end trace 0000000000000000 ]---\n\n[baolin.wang@linux.alibaba.com: remove less helpful comments, per Matthew]\n  Link: https://lkml.kernel.org/r/ccad3fe1375b468ebca3227b6b729f3eaf9d8046.1718423197.git.baolin.wang@linux.alibaba.com(CVE-2024-40949)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible NULL deref in fib6_nh_init()\n\nsyzbot reminds us that in6_dev_get() can return NULL.\n\nfib6_nh_init()\n    ip6_validate_gw(  \u0026amp;idev  )\n        ip6_route_check_nh(  idev  )\n            *idev = in6_dev_get(dev); // can be NULL\n\nOops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606\nCode: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b\nRSP: 0018:ffffc900032775a0 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000\nRDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8\nRBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000\nR10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8\nR13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000\nFS:  00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809\n  ip6_route_add+0x28/0x160 net/ipv6/route.c:3853\n  ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483\n  inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579\n  sock_do_ioctl+0x158/0x460 net/socket.c:1222\n  sock_ioctl+0x629/0x8e0 net/socket.c:1341\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f940f07cea9(CVE-2024-40961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni2c: lpi2c: Avoid calling clk_get_rate during transfer\n\nInstead of repeatedly calling clk_get_rate for each transfer, lock\nthe clock rate and cache the value.\nA deadlock has been observed while adding tlv320aic32x4 audio codec to\nthe system. When this clock provider adds its clock, the clk mutex is\nlocked already, it needs to access i2c, which in return needs the mutex\nfor clk_get_rate as well.(CVE-2024-40965)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\n\nWhen tearing down a redistributor region, make sure we don\u0026apos;t have\nany dangling pointer to that region stored in a vcpu.(CVE-2024-40989)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/sqpoll: work around a potential audit memory leak\n\nkmemleak complains that there\u0026apos;s a memory leak related to connect\nhandling:\n\nunreferenced object 0xffff0001093bdf00 (size 128):\ncomm \u0026quot;iou-sqp-455\u0026quot;, pid 457, jiffies 4294894164\nhex dump (first 32 bytes):\n02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00  ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nbacktrace (crc 2e481b1a):\n[\u0026lt;00000000c0a26af4\u0026gt;] kmemleak_alloc+0x30/0x38\n[\u0026lt;000000009c30bb45\u0026gt;] kmalloc_trace+0x228/0x358\n[\u0026lt;000000009da9d39f\u0026gt;] __audit_sockaddr+0xd0/0x138\n[\u0026lt;0000000089a93e34\u0026gt;] move_addr_to_kernel+0x1a0/0x1f8\n[\u0026lt;000000000b4e80e6\u0026gt;] io_connect_prep+0x1ec/0x2d4\n[\u0026lt;00000000abfbcd99\u0026gt;] io_submit_sqes+0x588/0x1e48\n[\u0026lt;00000000e7c25e07\u0026gt;] io_sq_thread+0x8a4/0x10e4\n[\u0026lt;00000000d999b491\u0026gt;] ret_from_fork+0x10/0x20\n\nwhich can can happen if:\n\n1) The command type does something on the prep side that triggers an\n   audit call.\n2) The thread hasn\u0026apos;t done any operations before this that triggered\n   an audit call inside -\u0026gt;issue(), where we have audit_uring_entry()\n   and audit_uring_exit().\n\nWork around this by issuing a blanket NOP operation before the SQPOLL\ndoes anything.(CVE-2024-41001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: vmalloc: check if a hash-index is in cpu_possible_mask\n\nThe problem is that there are systems where cpu_possible_mask has gaps\nbetween set CPUs, for example SPARC.  In this scenario addr_to_vb_xa()\nhash function can return an index which accesses to not-possible and not\nsetup CPU area using per_cpu() macro.  This results in an oops on SPARC.\n\nA per-cpu vmap_block_queue is also used as hash table, incorrectly\nassuming the cpu_possible_mask has no gaps.  Fix it by adjusting an index\nto a next possible CPU.(CVE-2024-41032)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\n\nThe following is emitted when using idxd (DSA) dmanegine as the data\nmover for ntb_transport that ntb_netdev uses.\n\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\n[74412.556784] caller is netif_rx_internal+0x42/0x130\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\n[74412.581699] Call Trace:\n[74412.584514]  \u0026lt;TASK\u0026gt;\n[74412.586933]  dump_stack_lvl+0x55/0x70\n[74412.591129]  check_preemption_disabled+0xc8/0xf0\n[74412.596374]  netif_rx_internal+0x42/0x130\n[74412.600957]  __netif_rx+0x20/0xd0\n[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\n[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]\n[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\n[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]\n[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]\n[74412.634046]  irq_thread_fn+0x21/0x60\n[74412.638134]  ? irq_thread+0xa8/0x290\n[74412.642218]  irq_thread+0x1a0/0x290\n[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10\n[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10\n[74412.656117]  ? __pfx_irq_thread+0x10/0x10\n[74412.660686]  kthread+0x100/0x130\n[74412.664384]  ? __pfx_kthread+0x10/0x10\n[74412.668639]  ret_from_fork+0x31/0x50\n[74412.672716]  ? __pfx_kthread+0x10/0x10\n[74412.676978]  ret_from_fork_asm+0x1a/0x30\n[74412.681457]  \u0026lt;/TASK\u0026gt;\n\nThe cause is due to the idxd driver interrupt completion handler uses\nthreaded interrupt and the threaded handler is not hard or soft interrupt\ncontext. However __netif_rx() can only be called from interrupt context.\nChange the call to netif_rx() in order to allow completion via normal\ncontext for dmaengine drivers that utilize threaded irq handling.\n\nWhile the following commit changed from netif_rx() to __netif_rx(),\nbaebdf48c360 (\u0026quot;net: dev: Makes sure netif_rx() can be invoked in any context.\u0026quot;),\nthe change should\u0026apos;ve been a noop instead. However, the code precedes this\nfix should\u0026apos;ve been using netif_rx_ni() or netif_rx_any_context().(CVE-2024-42110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_ref: remove folio_try_get_rcu()\n\nThe below bug was reported on a non-SMP kernel:\n\n[  275.267158][ T4335] ------------[ cut here ]------------\n[  275.267949][ T4335] kernel BUG at include/linux/page_ref.h:275!\n[  275.268526][ T4335] invalid opcode: 0000 [#1] KASAN PTI\n[  275.269001][ T4335] CPU: 0 PID: 4335 Comm: trinity-c3 Not tainted 6.7.0-rc4-00061-gefa7df3e3bb5 #1\n[  275.269787][ T4335] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[  275.270679][ T4335] RIP: 0010:try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3))\n[  275.272813][ T4335] RSP: 0018:ffffc90005dcf650 EFLAGS: 00010202\n[  275.273346][ T4335] RAX: 0000000000000246 RBX: ffffea00066e0000 RCX: 0000000000000000\n[  275.274032][ T4335] RDX: fffff94000cdc007 RSI: 0000000000000004 RDI: ffffea00066e0034\n[  275.274719][ T4335] RBP: ffffea00066e0000 R08: 0000000000000000 R09: fffff94000cdc006\n[  275.275404][ T4335] R10: ffffea00066e0037 R11: 0000000000000000 R12: 0000000000000136\n[  275.276106][ T4335] R13: ffffea00066e0034 R14: dffffc0000000000 R15: ffffea00066e0008\n[  275.276790][ T4335] FS:  00007fa2f9b61740(0000) GS:ffffffff89d0d000(0000) knlGS:0000000000000000\n[  275.277570][ T4335] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  275.278143][ T4335] CR2: 00007fa2f6c00000 CR3: 0000000134b04000 CR4: 00000000000406f0\n[  275.278833][ T4335] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  275.279521][ T4335] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  275.280201][ T4335] Call Trace:\n[  275.280499][ T4335]  \u0026lt;TASK\u0026gt;\n[ 275.280751][ T4335] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)\n[ 275.281087][ T4335] ? do_trap (arch/x86/kernel/traps.c:112 arch/x86/kernel/traps.c:153)\n[ 275.281463][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3))\n[ 275.281884][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3))\n[ 275.282300][ T4335] ? do_error_trap (arch/x86/kernel/traps.c:174)\n[ 275.282711][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3))\n[ 275.283129][ T4335] ? handle_invalid_op (arch/x86/kernel/traps.c:212)\n[ 275.283561][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3))\n[ 275.283990][ T4335] ? exc_invalid_op (arch/x86/kernel/traps.c:264)\n[ 275.284415][ T4335] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:568)\n[ 275.284859][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3))\n[ 275.285278][ T4335] try_grab_folio (mm/gup.c:148)\n[ 275.285684][ T4335] __get_user_pages (mm/gup.c:1297 (discriminator 1))\n[ 275.286111][ T4335] ? __pfx___get_user_pages (mm/gup.c:1188)\n[ 275.286579][ T4335] ? __pfx_validate_chain (kernel/locking/lockdep.c:3825)\n[ 275.287034][ T4335] ? mark_lock (kernel/locking/lockdep.c:4656 (discriminator 1))\n[ 275.287416][ T4335] __gup_longterm_locked (mm/gup.c:1509 mm/gup.c:2209)\n[ 275.288192][ T4335] ? __pfx___gup_longterm_locked (mm/gup.c:2204)\n[ 275.288697][ T4335] ? __pfx_lock_acquire (kernel/locking/lockdep.c:5722)\n[ 275.289135][ T4335] ? __pfx___might_resched (kernel/sched/core.c:10106)\n[ 275.289595][ T4335] pin_user_pages_remote (mm/gup.c:3350)\n[ 275.290041][ T4335] ? __pfx_pin_user_pages_remote (mm/gup.c:3350)\n[ 275.290545][ T4335] ? find_held_lock (kernel/locking/lockdep.c:5244 (discriminator 1))\n[ 275.290961][ T4335] ? mm_access (kernel/fork.c:1573)\n[ 275.291353][ T4335] process_vm_rw_single_vec+0x142/0x360\n[ 275.291900][ T4335] ? __pfx_process_vm_rw_single_vec+0x10/0x10\n[ 275.292471][ T4335] ? mm_access (kernel/fork.c:1573)\n[ 275.292859][ T4335] process_vm_rw_core+0x272/0x4e0\n[ 275.293384][ T4335] ? hlock_class (a\n---truncated---(CVE-2024-42251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix null reference error when checking end of zone\n\nThis patch fixes a potentially null pointer being accessed by\nis_end_zone_blkaddr() that checks the last block of a zone\nwhen f2fs is mounted as a single device.(CVE-2024-43857)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix event leak upon exit\n\nWhen a task is scheduled out, pending sigtrap deliveries are deferred\nto the target task upon resume to userspace via task_work.\n\nHowever failures while adding an event\u0026apos;s callback to the task_work\nengine are ignored. And since the last call for events exit happen\nafter task work is eventually closed, there is a small window during\nwhich pending sigtrap can be queued though ignored, leaking the event\nrefcount addition such as in the following scenario:\n\n    TASK A\n    -----\n\n    do_exit()\n       exit_task_work(tsk);\n\n       \u0026lt;IRQ\u0026gt;\n       perf_event_overflow()\n          event-\u0026gt;pending_sigtrap = pending_id;\n          irq_work_queue(\u0026amp;event-\u0026gt;pending_irq);\n       \u0026lt;/IRQ\u0026gt;\n    =========\u0026gt; PREEMPTION: TASK A -\u0026gt; TASK B\n       event_sched_out()\n          event-\u0026gt;pending_sigtrap = 0;\n          atomic_long_inc_not_zero(\u0026amp;event-\u0026gt;refcount)\n          // FAILS: task work has exited\n          task_work_add(\u0026amp;event-\u0026gt;pending_task)\n       [...]\n       \u0026lt;IRQ WORK\u0026gt;\n       perf_pending_irq()\n          // early return: event-\u0026gt;oncpu = -1\n       \u0026lt;/IRQ WORK\u0026gt;\n       [...]\n    =========\u0026gt; TASK B -\u0026gt; TASK A\n       perf_event_exit_task(tsk)\n          perf_event_exit_event()\n             free_event()\n                WARN(atomic_long_cmpxchg(\u0026amp;event-\u0026gt;refcount, 1, 0) != 1)\n                // leak event due to unexpected refcount == 2\n\nAs a result the event is never released while the task exits.\n\nFix this with appropriate task_work_add()\u0026apos;s error handling.(CVE-2024-43870)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Clean up error handling in vpci_scan_bus()\n\nSmatch complains about inconsistent NULL checking in vpci_scan_bus():\n\n    drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed \u0026apos;vpci_bus\u0026apos; could be null (see line 1021)\n\nInstead of printing an error message and then crashing we should return\nan error code and clean up.\n\nAlso the NULL check is reversed so it prints an error for success\ninstead of failure.(CVE-2024-43875)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()\n\nAvoid large backtrace, it is sufficient to warn the user that there has\nbeen a link problem. Either the link has failed and the system is in need\nof maintenance, or the link continues to work and user has been informed.\nThe message from the warning can be looked up in the sources.\n\nThis makes an actual link issue less verbose.\n\nFirst of all, this controller has a limitation in that the controller\ndriver has to assist the hardware with transition to L1 link state by\nwriting L1IATN to PMCTRL register, the L1 and L0 link state switching\nis not fully automatic on this controller.\n\nIn case of an ASMedia ASM1062 PCIe SATA controller which does not support\nASPM, on entry to suspend or during platform pm_test, the SATA controller\nenters D3hot state and the link enters L1 state. If the SATA controller\nwakes up before rcar_pcie_wakeup() was called and returns to D0, the link\nreturns to L0 before the controller driver even started its transition to\nL1 link state. At this point, the SATA controller did send an PM_ENTER_L1\nDLLP to the PCIe controller and the PCIe controller received it, and the\nPCIe controller did set PMSR PMEL1RX bit.\n\nOnce rcar_pcie_wakeup() is called, if the link is already back in L0 state\nand PMEL1RX bit is set, the controller driver has no way to determine if\nit should perform the link transition to L1 state, or treat the link as if\nit is in L0 state. Currently the driver attempts to perform the transition\nto L1 link state unconditionally, which in this specific case fails with a\nPMSR L1FAEG poll timeout, however the link still works as it is already\nback in L0 state.\n\nReduce this warning verbosity. In case the link is really broken, the\nrcar_pcie_config_access() would fail, otherwise it will succeed and any\nsystem with this controller and ASM1062 can suspend without generating\na backtrace.(CVE-2024-43876)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: ivtv: Add check for DMA map result\n\nIn case DMA fails, \u0026apos;dma-\u0026gt;SG_length\u0026apos; is 0. This value is later used to\naccess \u0026apos;dma-\u0026gt;SGarray[dma-\u0026gt;SG_length - 1]\u0026apos;, which will cause out of\nbounds access.\n\nAdd check to return early on invalid value. Adjust warnings accordingly.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-43877)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_erp: Fix object nesting warning\n\nACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM\n(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can\ncontain more ACLs (i.e., tc filters), but the number of masks in each\nregion (i.e., tc chain) is limited.\n\nIn order to mitigate the effects of the above limitation, the device\nallows filters to share a single mask if their masks only differ in up\nto 8 consecutive bits. For example, dst_ip/25 can be represented using\ndst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the\nnumber of masks being used (and therefore does not support mask\naggregation), but can contain a limited number of filters.\n\nThe driver uses the \u0026quot;objagg\u0026quot; library to perform the mask aggregation by\npassing it objects that consist of the filter\u0026apos;s mask and whether the\nfilter is to be inserted into the A-TCAM or the C-TCAM since filters in\ndifferent TCAMs cannot share a mask.\n\nThe set of created objects is dependent on the insertion order of the\nfilters and is not necessarily optimal. Therefore, the driver will\nperiodically ask the library to compute a more optimal set (\u0026quot;hints\u0026quot;) by\nlooking at all the existing objects.\n\nWhen the library asks the driver whether two objects can be aggregated\nthe driver only compares the provided masks and ignores the A-TCAM /\nC-TCAM indication. This is the right thing to do since the goal is to\nmove as many filters as possible to the A-TCAM. The driver also forbids\ntwo identical masks from being aggregated since this can only happen if\none was intentionally put in the C-TCAM to avoid a conflict in the\nA-TCAM.\n\nThe above can result in the following set of hints:\n\nH1: {mask X, A-TCAM} -\u0026gt; H2: {mask Y, A-TCAM} // X is Y + delta\nH3: {mask Y, C-TCAM} -\u0026gt; H4: {mask Z, A-TCAM} // Y is Z + delta\n\nAfter getting the hints from the library the driver will start migrating\nfilters from one region to another while consulting the computed hints\nand instructing the device to perform a lookup in both regions during\nthe transition.\n\nAssuming a filter with mask X is being migrated into the A-TCAM in the\nnew region, the hints lookup will return H1. Since H2 is the parent of\nH1, the library will try to find the object associated with it and\ncreate it if necessary in which case another hints lookup (recursive)\nwill be performed. This hints lookup for {mask Y, A-TCAM} will either\nreturn H2 or H3 since the driver passes the library an object comparison\nfunction that ignores the A-TCAM / C-TCAM indication.\n\nThis can eventually lead to nested objects which are not supported by\nthe library [1].\n\nFix by removing the object comparison function from both the driver and\nthe library as the driver was the only user. That way the lookup will\nonly return exact matches.\n\nI do not have a reliable reproducer that can reproduce the issue in a\ntimely manner, but before the fix the issue would reproduce in several\nminutes and with the fix it does not reproduce in over an hour.\n\nNote that the current usefulness of the hints is limited because they\ninclude the C-TCAM indication and represent aggregation that cannot\nactually happen. This will be addressed in net-next.\n\n[1]\nWARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0\nModules linked in:\nCPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42\nHardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:objagg_obj_parent_assign+0xb5/0xd0\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __objagg_obj_get+0x2bb/0x580\n objagg_obj_get+0xe/0x80\n mlxsw_sp_acl_erp_mask_get+0xb5/0xf0\n mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370(CVE-2024-43880)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: change DMA direction while mapping reinjected packets\n\nFor fragmented packets, ath12k reassembles each fragment as a normal\npacket and then reinjects it into HW ring. In this case, the DMA\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\nan invalid payload may be reinjected into the HW and\nsubsequently delivered to the host.\n\nGiven that arbitrary memory can be allocated to the skb buffer,\nknowledge about the data contained in the reinjected buffer is lacking.\nConsequently, there’s a risk of private information being leaked.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1(CVE-2024-43881)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen: privcmd: Switch from mutex to spinlock for irqfds\n\nirqfd_wakeup() gets EPOLLHUP, when it is called by\neventfd_release() by way of wake_up_poll(\u0026amp;ctx-\u0026gt;wqh, EPOLLHUP), which\ngets called under spin_lock_irqsave(). We can\u0026apos;t use a mutex here as it\nwill lead to a deadlock.\n\nFix it by switching over to a spin lock.(CVE-2024-44957)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntick/broadcast: Move per CPU pointer access into the atomic section\n\nThe recent fix for making the take over of the broadcast timer more\nreliable retrieves a per CPU pointer in preemptible context.\n\nThis went unnoticed as compilers hoist the access into the non-preemptible\nregion where the pointer is actually used. But of course it\u0026apos;s valid that\nthe compiler keeps it at the place where the code puts it which rightfully\ntriggers:\n\n  BUG: using smp_processor_id() in preemptible [00000000] code:\n       caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0\n\nMove it to the actual usage site which is in a non-preemptible region.(CVE-2024-44968)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not clear page dirty inside extent_write_locked_range()\n\n[BUG]\nFor subpage + zoned case, the following workload can lead to rsv data\nleak at unmount time:\n\n  # mkfs.btrfs -f -s 4k $dev\n  # mount $dev $mnt\n  # fsstress -w -n 8 -d $mnt -s 1709539240\n  0/0: fiemap - no filename\n  0/1: copyrange read - no filename\n  0/2: write - no filename\n  0/3: rename - no source filename\n  0/4: creat f0 x:0 0 0\n  0/4: creat add id=0,parent=-1\n  0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0\n  0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1\n  0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat()\n  0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0\n  # umount $mnt\n\nThe dmesg includes the following rsv leak detection warning (all call\ntrace skipped):\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8653 btrfs_destroy_inode+0x1e0/0x200 [btrfs]\n  ---[ end trace 0000000000000000 ]---\n  ------------[ cut here ]------------\n  WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8654 btrfs_destroy_inode+0x1a8/0x200 [btrfs]\n  ---[ end trace 0000000000000000 ]---\n  ------------[ cut here ]------------\n  WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8660 btrfs_destroy_inode+0x1a0/0x200 [btrfs]\n  ---[ end trace 0000000000000000 ]---\n  BTRFS info (device sda): last unmount of filesystem 1b4abba9-de34-4f07-9e7f-157cf12a18d6\n  ------------[ cut here ]------------\n  WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]\n  ---[ end trace 0000000000000000 ]---\n  BTRFS info (device sda): space_info DATA has 268218368 free, is not full\n  BTRFS info (device sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0\n  BTRFS info (device sda): global_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): trans_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0\n  ------------[ cut here ]------------\n  WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]\n  ---[ end trace 0000000000000000 ]---\n  BTRFS info (device sda): space_info METADATA has 267796480 free, is not full\n  BTRFS info (device sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760\n  BTRFS info (device sda): global_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): trans_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0\n  BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0\n\nAbove $dev is a tcmu-runner emulated zoned HDD, which has a max zone\nappend size of 64K, and the system has 64K page size.\n\n[CAUSE]\nI have added several trace_printk() to show the events (header skipped):\n\n  \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688\n  \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288\n  \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536\n  \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864\n\nThe above lines show our buffered write has dirtied 3 pages of inode\n259 of root 5:\n\n  704K             768K              832K              896K\n  I           |////I/////////////////I///////////|     I\n              756K                               868K\n\n  |///| is the dirtied range using subpage bitmaps. and \u0026apos;I\u0026apos; is the page\n  boundary.\n\n  Meanwhile all three pages (704K, 768K, 832K) have their PageDirty\n  flag set.\n\n  \u0026gt; btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400\n\nThen direct IO writ\n---truncated---(CVE-2024-44972)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: fix panic caused by partcmd_update\n\nWe find a bug as below:\nBUG: unable to handle page fault for address: 00000003\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 358 Comm: bash Tainted: G        W I        6.6.0-10893-g60d6\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/4\nRIP: 0010:partition_sched_domains_locked+0x483/0x600\nCode: 01 48 85 d2 74 0d 48 83 05 29 3f f8 03 01 f3 48 0f bc c2 89 c0 48 9\nRSP: 0018:ffffc90000fdbc58 EFLAGS: 00000202\nRAX: 0000000100000003 RBX: ffff888100b3dfa0 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000002fe80\nRBP: ffff888100b3dfb0 R08: 0000000000000001 R09: 0000000000000000\nR10: ffffc90000fdbcb0 R11: 0000000000000004 R12: 0000000000000002\nR13: ffff888100a92b48 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007f44a5425740(0000) GS:ffff888237d80000(0000) knlGS:0000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000100030973 CR3: 000000010722c000 CR4: 00000000000006e0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x8c/0xa0\n ? __die_body+0x23/0xa0\n ? __die+0x3a/0x50\n ? page_fault_oops+0x1d2/0x5c0\n ? partition_sched_domains_locked+0x483/0x600\n ? search_module_extables+0x2a/0xb0\n ? search_exception_tables+0x67/0x90\n ? kernelmode_fixup_or_oops+0x144/0x1b0\n ? __bad_area_nosemaphore+0x211/0x360\n ? up_read+0x3b/0x50\n ? bad_area_nosemaphore+0x1a/0x30\n ? exc_page_fault+0x890/0xd90\n ? __lock_acquire.constprop.0+0x24f/0x8d0\n ? __lock_acquire.constprop.0+0x24f/0x8d0\n ? asm_exc_page_fault+0x26/0x30\n ? partition_sched_domains_locked+0x483/0x600\n ? partition_sched_domains_locked+0xf0/0x600\n rebuild_sched_domains_locked+0x806/0xdc0\n update_partition_sd_lb+0x118/0x130\n cpuset_write_resmask+0xffc/0x1420\n cgroup_file_write+0xb2/0x290\n kernfs_fop_write_iter+0x194/0x290\n new_sync_write+0xeb/0x160\n vfs_write+0x16f/0x1d0\n ksys_write+0x81/0x180\n __x64_sys_write+0x21/0x30\n x64_sys_call+0x2f25/0x4630\n do_syscall_64+0x44/0xb0\n entry_SYSCALL_64_after_hwframe+0x78/0xe2\nRIP: 0033:0x7f44a553c887\n\nIt can be reproduced with cammands:\ncd /sys/fs/cgroup/\nmkdir test\ncd test/\necho +cpuset \u0026gt; ../cgroup.subtree_control\necho root \u0026gt; cpuset.cpus.partition\ncat /sys/fs/cgroup/cpuset.cpus.effective\n0-3\necho 0-3 \u0026gt; cpuset.cpus // taking away all cpus from root\n\nThis issue is caused by the incorrect rebuilding of scheduling domains.\nIn this scenario, test/cpuset.cpus.partition should be an invalid root\nand should not trigger the rebuilding of scheduling domains. When calling\nupdate_parent_effective_cpumask with partcmd_update, if newmask is not\nnull, it should recheck newmask whether there are cpus is available\nfor parect/cs that has tasks.(CVE-2024-44975)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix RX buf alloc_size alignment and atomic op panic\n\nThe MANA driver\u0026apos;s RX buffer alloc_size is passed into napi_build_skb() to\ncreate SKB. skb_shinfo(skb) is located at the end of skb, and its alignment\nis affected by the alloc_size passed into napi_build_skb(). The size needs\nto be aligned properly for better performance and atomic operations.\nOtherwise, on ARM64 CPU, for certain MTU settings like 4000, atomic\noperations may panic on the skb_shinfo(skb)-\u0026gt;dataref due to alignment fault.\n\nTo fix this bug, add proper alignment to the alloc_size calculation.\n\nSample panic info:\n[  253.298819] Unable to handle kernel paging request at virtual address ffff000129ba5cce\n[  253.300900] Mem abort info:\n[  253.301760]   ESR = 0x0000000096000021\n[  253.302825]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  253.304268]   SET = 0, FnV = 0\n[  253.305172]   EA = 0, S1PTW = 0\n[  253.306103]   FSC = 0x21: alignment fault\nCall trace:\n __skb_clone+0xfc/0x198\n skb_clone+0x78/0xe0\n raw6_local_deliver+0xfc/0x228\n ip6_protocol_deliver_rcu+0x80/0x500\n ip6_input_finish+0x48/0x80\n ip6_input+0x48/0xc0\n ip6_sublist_rcv_finish+0x50/0x78\n ip6_sublist_rcv+0x1cc/0x2b8\n ipv6_list_rcv+0x100/0x150\n __netif_receive_skb_list_core+0x180/0x220\n netif_receive_skb_list_internal+0x198/0x2a8\n __napi_poll+0x138/0x250\n net_rx_action+0x148/0x330\n handle_softirqs+0x12c/0x3a0(CVE-2024-45001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: fix validity interception issue when gisa is switched off\n\nWe might run into a SIE validity if gisa has been disabled either via using\nkernel parameter \u0026quot;kvm.use_gisa=0\u0026quot; or by setting the related sysfs\nattribute to N (echo N \u0026gt;/sys/module/kvm/parameters/use_gisa).\n\nThe validity is caused by an invalid value in the SIE control block\u0026apos;s\ngisa designation. That happens because we pass the uninitialized gisa\norigin to virt_to_phys() before writing it to the gisa designation.\n\nTo fix this we return 0 in kvm_s390_get_gisa_desc() if the origin is 0.\nkvm_s390_get_gisa_desc() is used to determine which gisa designation to\nset in the SIE control block. A value of 0 in the gisa designation disables\ngisa usage.\n\nThe issue surfaces in the host kernel with the following kernel message as\nsoon a new kvm guest start is attemted.\n\nkvm: unhandled validity intercept 0x1011\nWARNING: CPU: 0 PID: 781237 at arch/s390/kvm/intercept.c:101 kvm_handle_sie_intercept+0x42e/0x4d0 [kvm]\nModules linked in: vhost_net tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT xt_tcpudp nft_compat x_tables nf_nat_tftp nf_conntrack_tftp vfio_pci_core irqbypass vhost_vsock vmw_vsock_virtio_transport_common vsock vhost vhost_iotlb kvm nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables sunrpc mlx5_ib ib_uverbs ib_core mlx5_core uvdevice s390_trng eadm_sch vfio_ccw zcrypt_cex4 mdev vfio_iommu_type1 vfio sch_fq_codel drm i2c_core loop drm_panel_orientation_quirks configfs nfnetlink lcs ctcm fsm dm_service_time ghash_s390 prng chacha_s390 libchacha aes_s390 des_s390 libdes sha3_512_s390 sha3_256_s390 sha512_s390 sha256_s390 sha1_s390 sha_common dm_mirror dm_region_hash dm_log zfcp scsi_transport_fc scsi_dh_rdac scsi_dh_emc scsi_dh_alua pkey zcrypt dm_multipath rng_core autofs4 [last unloaded: vfio_pci]\nCPU: 0 PID: 781237 Comm: CPU 0/KVM Not tainted 6.10.0-08682-gcad9f11498ea #6\nHardware name: IBM 3931 A01 701 (LPAR)\nKrnl PSW : 0704c00180000000 000003d93deb0122 (kvm_handle_sie_intercept+0x432/0x4d0 [kvm])\n           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3\nKrnl GPRS: 000003d900000027 000003d900000023 0000000000000028 000002cd00000000\n           000002d063a00900 00000359c6daf708 00000000000bebb5 0000000000001eff\n           000002cfd82e9000 000002cfd80bc000 0000000000001011 000003d93deda412\n           000003ff8962df98 000003d93de77ce0 000003d93deb011e 00000359c6daf960\nKrnl Code: 000003d93deb0112: c020fffe7259\tlarl\t%r2,000003d93de7e5c4\n           000003d93deb0118: c0e53fa8beac\tbrasl\t%r14,000003d9bd3c7e70\n          #000003d93deb011e: af000000\t\tmc\t0,0\n          \u0026gt;000003d93deb0122: a728ffea\t\tlhi\t%r2,-22\n           000003d93deb0126: a7f4fe24\t\tbrc\t15,000003d93deafd6e\n           000003d93deb012a: 9101f0b0\t\ttm\t176(%r15),1\n           000003d93deb012e: a774fe48\t\tbrc\t7,000003d93deafdbe\n           000003d93deb0132: 40a0f0ae\t\tsth\t%r10,174(%r15)\nCall Trace:\n [\u0026lt;000003d93deb0122\u0026gt;] kvm_handle_sie_intercept+0x432/0x4d0 [kvm]\n([\u0026lt;000003d93deb011e\u0026gt;] kvm_handle_sie_intercept+0x42e/0x4d0 [kvm])\n [\u0026lt;000003d93deacc10\u0026gt;] vcpu_post_run+0x1d0/0x3b0 [kvm]\n [\u0026lt;000003d93deaceda\u0026gt;] __vcpu_run+0xea/0x2d0 [kvm]\n [\u0026lt;000003d93dead9da\u0026gt;] kvm_arch_vcpu_ioctl_run+0x16a/0x430 [kvm]\n [\u0026lt;000003d93de93ee0\u0026gt;] kvm_vcpu_ioctl+0x190/0x7c0 [kvm]\n [\u0026lt;000003d9bd728b4e\u0026gt;] vfs_ioctl+0x2e/0x70\n [\u0026lt;000003d9bd72a092\u0026gt;] __s390x_sys_ioctl+0xc2/0xd0\n [\u0026lt;000003d9be0e9222\u0026gt;] __do_syscall+0x1f2/0x2e0\n [\u0026lt;000003d9be0f9a90\u0026gt;] system_call+0x70/0x98\nLast Breaking-Event-Address:\n [\u0026lt;000003d9bd3c7f58\u0026gt;] __warn_printk+0xe8/0xf0(CVE-2024-45005)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nchar: xillybus: Don\u0026apos;t destroy workqueue from work item running on it\n\nTriggered by a kref decrement, destroy_workqueue() may be called from\nwithin a work item for destroying its own workqueue. This illegal\nsituation is averted by adding a module-global workqueue for exclusive\nuse of the offending work item. Other work items continue to be queued\non per-device workqueues to ensure performance.(CVE-2024-45007)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/firmware: use dma non-coherent allocator\n\nCurrently, enabling SG_DEBUG in the kernel will cause nouveau to hit a\nBUG() on startup, when the iommu is enabled:\n\nkernel BUG at include/linux/scatterlist.h:187!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 7 PID: 930 Comm: (udev-worker) Not tainted 6.9.0-rc3Lyude-Test+ #30\nHardware name: MSI MS-7A39/A320M GAMING PRO (MS-7A39), BIOS 1.I0 01/22/2019\nRIP: 0010:sg_init_one+0x85/0xa0\nCode: 69 88 32 01 83 e1 03 f6 c3 03 75 20 a8 01 75 1e 48 09 cb 41 89 54\n24 08 49 89 1c 24 41 89 6c 24 0c 5b 5d 41 5c e9 7b b9 88 00 \u0026lt;0f\u0026gt; 0b 0f 0b\n0f 0b 48 8b 05 5e 46 9a 01 eb b2 66 66 2e 0f 1f 84 00\nRSP: 0018:ffffa776017bf6a0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffa77600d87000 RCX: 000000000000002b\nRDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffa77680d87000\nRBP: 000000000000e000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff98f4c46aa508 R11: 0000000000000000 R12: ffff98f4c46aa508\nR13: ffff98f4c46aa008 R14: ffffa77600d4a000 R15: ffffa77600d4a018\nFS:  00007feeb5aae980(0000) GS:ffff98f5c4dc0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f22cb9a4520 CR3: 00000001043ba000 CR4: 00000000003506f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? die+0x36/0x90\n ? do_trap+0xdd/0x100\n ? sg_init_one+0x85/0xa0\n ? do_error_trap+0x65/0x80\n ? sg_init_one+0x85/0xa0\n ? exc_invalid_op+0x50/0x70\n ? sg_init_one+0x85/0xa0\n ? asm_exc_invalid_op+0x1a/0x20\n ? sg_init_one+0x85/0xa0\n nvkm_firmware_ctor+0x14a/0x250 [nouveau]\n nvkm_falcon_fw_ctor+0x42/0x70 [nouveau]\n ga102_gsp_booter_ctor+0xb4/0x1a0 [nouveau]\n r535_gsp_oneinit+0xb3/0x15f0 [nouveau]\n ? srso_return_thunk+0x5/0x5f\n ? srso_return_thunk+0x5/0x5f\n ? nvkm_udevice_new+0x95/0x140 [nouveau]\n ? srso_return_thunk+0x5/0x5f\n ? srso_return_thunk+0x5/0x5f\n ? ktime_get+0x47/0xb0\n\nFix this by using the non-coherent allocator instead, I think there\nmight be a better answer to this, but it involve ripping up some of\nAPIs using sg lists.(CVE-2024-45012)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0\n\nThe __vmap_pages_range_noflush() assumes its argument pages** contains\npages with the same page shift.  However, since commit e9c3cda4d86e (\u0026quot;mm,\nvmalloc: fix high order __GFP_NOFAIL allocations\u0026quot;), if gfp_flags includes\n__GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation\nfailed for high order, the pages** may contain two different page shifts\n(high order and order-0).  This could lead __vmap_pages_range_noflush() to\nperform incorrect mappings, potentially resulting in memory corruption.\n\nUsers might encounter this as follows (vmap_allow_huge = true, 2M is for\nPMD_SIZE):\n\nkvmalloc(2M, __GFP_NOFAIL|GFP_X)\n    __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)\n        vm_area_alloc_pages(order=9) ---\u0026gt; order-9 allocation failed and fallback to order-0\n            vmap_pages_range()\n                vmap_pages_range_noflush()\n                    __vmap_pages_range_noflush(page_shift = 21) ----\u0026gt; wrong mapping happens\n\nWe can remove the fallback code because if a high-order allocation fails,\n__vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is\nunnecessary to fallback to order-0 here.  Therefore, fix this by removing\nthe fallback code.(CVE-2024-45022)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion\n\nwpa_supplicant 2.11 sends since 1efdba5fdc2c (\u0026quot;Handle PMKSA flush in the\ndriver for SAE/OWE offload cases\u0026quot;) SSID based PMKSA del commands.\nbrcmfmac is not prepared and tries to dereference the NULL bssid and\npmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based\nupdates so copy the SSID.(CVE-2024-46672)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix random crash seen while removing driver\n\nThis fixes the random kernel crash seen while removing the driver, when\nrunning the load/unload test over multiple iterations.\n\n1) modprobe btnxpuart\n2) hciconfig hci0 reset\n3) hciconfig (check hci0 interface up with valid BD address)\n4) modprobe -r btnxpuart\nRepeat steps 1 to 4\n\nThe ps_wakeup() call in btnxpuart_close() schedules the psdata-\u0026gt;work(),\nwhich gets scheduled after module is removed, causing a kernel crash.\n\nThis hidden issue got highlighted after enabling Power Save by default\nin 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature on\nstartup)\n\nThe new ps_cleanup() deasserts UART break immediately while closing\nserdev device, cancels any scheduled ps_work and destroys the ps_lock\nmutex.\n\n[   85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258\n[   85.884624] Mem abort info:\n[   85.884625]   ESR = 0x0000000086000007\n[   85.884628]   EC = 0x21: IABT (current EL), IL = 32 bits\n[   85.884633]   SET = 0, FnV = 0\n[   85.884636]   EA = 0, S1PTW = 0\n[   85.884638]   FSC = 0x07: level 3 translation fault\n[   85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041dd0000\n[   85.884646] [ffffd4a61638f258] pgd=1000000095fff003, p4d=1000000095fff003, pud=100000004823d003, pmd=100000004823e003, pte=0000000000000000\n[   85.884662] Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP\n[   85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)]\n[   85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G           O       6.1.36+g937b1be4345a #1\n[   85.936176] Hardware name: FSL i.MX8MM EVK board (DT)\n[   85.936182] Workqueue: events 0xffffd4a61638f380\n[   85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   85.952817] pc : 0xffffd4a61638f258\n[   85.952823] lr : 0xffffd4a61638f258\n[   85.952827] sp : ffff8000084fbd70\n[   85.952829] x29: ffff8000084fbd70 x28: 0000000000000000 x27: 0000000000000000\n[   85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305\n[   85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970\n[   85.977382] x20: 0000000000000000 x19: ffff4bf1c8540880 x18: 0000000000000000\n[   85.977391] x17: 0000000000000000 x16: 0000000000000133 x15: 0000ffffe2217090\n[   85.977399] x14: 0000000000000001 x13: 0000000000000133 x12: 0000000000000139\n[   85.977407] x11: 0000000000000001 x10: 0000000000000a60 x9 : ffff8000084fbc50\n[   85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 : 00000000000003e8\n[   85.977424] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000000\n[   85.977432] x2 : 0000000000000000 x1 : ffff4bf1c4265880 x0 : 0000000000000000\n[   85.977443] Call trace:\n[   85.977446]  0xffffd4a61638f258\n[   85.977451]  0xffffd4a61638f3e8\n[   85.977455]  process_one_work+0x1d4/0x330\n[   85.977464]  worker_thread+0x6c/0x430\n[   85.977471]  kthread+0x108/0x10c\n[   85.977476]  ret_from_fork+0x10/0x20\n[   85.977488] Code: bad PC value\n[   85.977491] ---[ end trace 0000000000000000 ]---\n\nPreset since v6.9.11(CVE-2024-46680)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: pmic_glink: Fix race during initialization\n\nAs pointed out by Stephen Boyd it is possible that during initialization\nof the pmic_glink child drivers, the protection-domain notifiers fires,\nand the associated work is scheduled, before the client registration\nreturns and as a result the local \u0026quot;client\u0026quot; pointer has been initialized.\n\nThe outcome of this is a NULL pointer dereference as the \u0026quot;client\u0026quot;\npointer is blindly dereferenced.\n\nTimeline provided by Stephen:\n CPU0                               CPU1\n ----                               ----\n ucsi-\u0026gt;client = NULL;\n devm_pmic_glink_register_client()\n  client-\u0026gt;pdr_notify(client-\u0026gt;priv, pg-\u0026gt;client_state)\n   pmic_glink_ucsi_pdr_notify()\n    schedule_work(\u0026amp;ucsi-\u0026gt;register_work)\n    \u0026lt;schedule away\u0026gt;\n                                    pmic_glink_ucsi_register()\n                                     ucsi_register()\n                                      pmic_glink_ucsi_read_version()\n                                       pmic_glink_ucsi_read()\n                                        pmic_glink_ucsi_read()\n                                         pmic_glink_send(ucsi-\u0026gt;client)\n                                         \u0026lt;client is NULL BAD\u0026gt;\n ucsi-\u0026gt;client = client // Too late!\n\nThis code is identical across the altmode, battery manager and usci\nchild drivers.\n\nResolve this by splitting the allocation of the \u0026quot;client\u0026quot; object and the\nregistration thereof into two operations.\n\nThis only happens if the protection domain registry is populated at the\ntime of registration, which by the introduction of commit \u0026apos;1ebcde047c54\n(\u0026quot;soc: qcom: add pd-mapper implementation\u0026quot;)\u0026apos; became much more likely.(CVE-2024-46693)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: avoid using null object of framebuffer\n\nInstead of using state-\u0026gt;fb-\u0026gt;obj[0] directly, get object from framebuffer\nby calling drm_gem_fb_get_obj() and return error code when object is\nnull to avoid using null object of framebuffer.\n\n(cherry picked from commit 73dd0ad9e5dad53766ea3e631303430116f834b3)(CVE-2024-46694)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: fix ID 0 endp usage after multiple re-creations\n\n\u0026apos;local_addr_used\u0026apos; and \u0026apos;add_addr_accepted\u0026apos; are decremented for addresses\nnot related to the initial subflow (ID0), because the source and\ndestination addresses of the initial subflows are known from the\nbeginning: they don\u0026apos;t count as \u0026quot;additional local address being used\u0026quot; or\n\u0026quot;ADD_ADDR being accepted\u0026quot;.\n\nIt is then required not to increment them when the entrypoint used by\nthe initial subflow is removed and re-added during a connection. Without\nthis modification, this entrypoint cannot be removed and re-added more\nthan once.(CVE-2024-46711)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix double free of \u0026apos;buf\u0026apos; in error path\n\nsmatch warning:\ndrivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of \u0026apos;buf\u0026apos;\n\nIn fastrpc_req_mmap() error path, the fastrpc buffer is freed in\nfastrpc_req_munmap_impl() if unmap is successful.\n\nBut in the end, there is an unconditional call to fastrpc_buf_free().\nSo the above case triggers the double free of fastrpc buf.(CVE-2024-46741)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: void array out of bound when loop tnl_num\n\nWhen query reg inf of SSU, it loops tnl_num times. However, tnl_num comes\nfrom hardware and the length of array is a fixed value. To void array out\nof bound, make sure the loop time is not greater than the length of array(CVE-2024-46833)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: vmalloc: ensure vmap_block is initialised before adding to queue\n\nCommit 8c61291fd850 (\u0026quot;mm: fix incorrect vbq reference in\npurge_fragmented_block\u0026quot;) extended the \u0026apos;vmap_block\u0026apos; structure to contain a\n\u0026apos;cpu\u0026apos; field which is set at allocation time to the id of the initialising\nCPU.\n\nWhen a new \u0026apos;vmap_block\u0026apos; is being instantiated by new_vmap_block(), the\npartially initialised structure is added to the local \u0026apos;vmap_block_queue\u0026apos;\nxarray before the \u0026apos;cpu\u0026apos; field has been initialised.  If another CPU is\nconcurrently walking the xarray (e.g.  via vm_unmap_aliases()), then it\nmay perform an out-of-bounds access to the remote queue thanks to an\nuninitialised index.\n\nThis has been observed as UBSAN errors in Android:\n\n | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n |\n | Call trace:\n |  purge_fragmented_block+0x204/0x21c\n |  _vm_unmap_aliases+0x170/0x378\n |  vm_unmap_aliases+0x1c/0x28\n |  change_memory_common+0x1dc/0x26c\n |  set_memory_ro+0x18/0x24\n |  module_enable_ro+0x98/0x238\n |  do_init_module+0x1b0/0x310\n\nMove the initialisation of \u0026apos;vb-\u0026gt;cpu\u0026apos; in new_vmap_block() ahead of the\naddition to the xarray.(CVE-2024-46847)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: fix kexec crash due to VP assist page corruption\n\ncommit 9636be85cc5b (\u0026quot;x86/hyperv: Fix hyperv_pcpu_input_arg handling when\nCPUs go online/offline\u0026quot;) introduces a new cpuhp state for hyperv\ninitialization.\n\ncpuhp_setup_state() returns the state number if state is\nCPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN and 0 for all other states.\nFor the hyperv case, since a new cpuhp state was introduced it would\nreturn 0. However, in hv_machine_shutdown(), the cpuhp_remove_state() call\nis conditioned upon \u0026quot;hyperv_init_cpuhp \u0026gt; 0\u0026quot;. This will never be true and\nso hv_cpu_die() won\u0026apos;t be called on all CPUs. This means the VP assist page\nwon\u0026apos;t be reset. When the kexec kernel tries to setup the VP assist page\nagain, the hypervisor corrupts the memory region of the old VP assist page\ncausing a panic in case the kexec kernel is using that memory elsewhere.\nThis was originally fixed in commit dfe94d4086e4 (\u0026quot;x86/hyperv: Fix kexec\npanic/hang issues\u0026quot;).\n\nGet rid of hyperv_init_cpuhp entirely since we are no longer using a\ndynamic cpuhp state and use CPUHP_AP_HYPERV_ONLINE directly with\ncpuhp_remove_state().(CVE-2024-46864)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfou: fix initialization of grc\n\nThe grc must be initialize first. There can be a condition where if\nfou is NULL, goto out will be executed and grc would be used\nuninitialized.(CVE-2024-46865)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - inject error before stopping queue\n\nThe master ooo cannot be completely closed when the\naccelerator core reports memory error. Therefore, the driver\nneeds to inject the qm error to close the master ooo. Currently,\nthe qm error is injected after stopping queue, memory may be\nreleased immediately after stopping queue, causing the device to\naccess the released memory. Therefore, error is injected to close master\nooo before stopping queue to ensure that the device does not access\nthe released memory.(CVE-2024-47730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled\n\nFix missuse of spin_lock_irq()/spin_unlock_irq() when\nspin_lock_irqsave()/spin_lock_irqrestore() was hold.\n\nThis was discovered through the lock debugging, and the corresponding\nlog is as follows:\n\nraw_local_irq_restore() called with IRQs enabled\nWARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40\n...\nCall trace:\n warn_bogus_irq_restore+0x30/0x40\n _raw_spin_unlock_irqrestore+0x84/0xc8\n add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2]\n hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2]\n hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2]\n create_qp+0x138/0x258\n ib_create_qp_kernel+0x50/0xe8\n create_mad_qp+0xa8/0x128\n ib_mad_port_open+0x218/0x448\n ib_mad_init_device+0x70/0x1f8\n add_client_context+0xfc/0x220\n enable_device_and_get+0xd0/0x140\n ib_register_device.part.0+0xf4/0x1c8\n ib_register_device+0x34/0x50\n hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2]\n hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2]\n __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2]\n hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2](CVE-2024-47735)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix a race between socket set up and I/O thread creation\n\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\nthread that will handle it.  This is a problem, however, as there\u0026apos;s a gap\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\nthread.\n\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there\u0026apos;s\nno I/O thread yet.\n\nA better, but more intrusive fix would perhaps be to rearrange things such\nthat the socket creation is done by the I/O thread.(CVE-2024-49864)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a sdiv overflow issue\n\nZac Ecob reported a problem where a bpf program may cause kernel crash due\nto the following error:\n  Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\n\nThe failure is due to the below signed divide:\n  LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.\nLLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,\nbut it is impossible since for 64-bit system, the maximum positive\nnumber is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will\ncause a kernel exception. On arm64, the result for LLONG_MIN/-1 is\nLLONG_MIN.\n\nFurther investigation found all the following sdiv/smod cases may trigger\nan exception when bpf program is running on x86_64 platform:\n  - LLONG_MIN/-1 for 64bit operation\n  - INT_MIN/-1 for 32bit operation\n  - LLONG_MIN%-1 for 64bit operation\n  - INT_MIN%-1 for 32bit operation\nwhere -1 can be an immediate or in a register.\n\nOn arm64, there are no exceptions:\n  - LLONG_MIN/-1 = LLONG_MIN\n  - INT_MIN/-1 = INT_MIN\n  - LLONG_MIN%-1 = 0\n  - INT_MIN%-1 = 0\nwhere -1 can be an immediate or in a register.\n\nInsn patching is needed to handle the above cases and the patched codes\nproduced results aligned with above arm64 result. The below are pseudo\ncodes to handle sdiv/smod exceptions including both divisor -1 and divisor 0\nand the divisor is stored in a register.\n\nsdiv:\n      tmp = rX\n      tmp += 1 /* [-1, 0] -\u0026gt; [0, 1]\n      if tmp \u0026gt;(unsigned) 1 goto L2\n      if tmp == 0 goto L1\n      rY = 0\n  L1:\n      rY = -rY;\n      goto L3\n  L2:\n      rY /= rX\n  L3:\n\nsmod:\n      tmp = rX\n      tmp += 1 /* [-1, 0] -\u0026gt; [0, 1]\n      if tmp \u0026gt;(unsigned) 1 goto L1\n      if tmp == 1 (is64 ? goto L2 : goto L3)\n      rY = 0;\n      goto L2\n  L1:\n      rY %= rX\n  L2:\n      goto L4  // only when !is64\n  L3:\n      wY = wY  // only when !is64\n  L4:\n\n  [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/(CVE-2024-49888)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()\n\nFor kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is\ndefined as NR_CPUS instead of the number of possible cpus, this\nwill cause the following system panic:\n\nsmpboot: Allowing 4 CPUs, 0 hotplug CPUs\n...\nsetup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1\n...\nBUG: unable to handle page fault for address: ffffffff9911c8c8\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W\n6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6\nRIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0\nRSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082\nCR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? __die+0x23/0x80\n? page_fault_oops+0xa4/0x180\n? exc_page_fault+0x152/0x180\n? asm_exc_page_fault+0x26/0x40\n? rcu_tasks_need_gpcb+0x25d/0x2c0\n? __pfx_rcu_tasks_kthread+0x40/0x40\nrcu_tasks_one_gp+0x69/0x180\nrcu_tasks_kthread+0x94/0xc0\nkthread+0xe8/0x140\n? __pfx_kthread+0x40/0x40\nret_from_fork+0x34/0x80\n? __pfx_kthread+0x40/0x40\nret_from_fork_asm+0x1b/0x80\n\u0026lt;/TASK\u0026gt;\n\nConsidering that there may be holes in the CPU numbers, use the\nmaximum possible cpu number, instead of nr_cpu_ids, for configuring\nenqueue and dequeue limits.\n\n[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ](CVE-2024-49926)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to add interface to list twice when SER\n\nIf SER L2 occurs during the WoWLAN resume flow, the add interface flow\nis triggered by ieee80211_reconfig(). However, due to\nrtw89_wow_resume() return failure, it will cause the add interface flow\nto be executed again, resulting in a double add list and causing a kernel\npanic. Therefore, we have added a check to prevent double adding of the\nlist.\n\nlist_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628.\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:37!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G        W  O       6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7\nHardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021\nWorkqueue: events_freezable ieee80211_restart_work [mac80211]\nRIP: 0010:__list_add_valid_or_report+0x5e/0xb0\nCode: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 \u0026lt;0f\u0026gt; 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12\nRSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246\nRAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900\nRDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001\nRBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0\nR10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060\nR13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010\nFS:  0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die_body+0x1f/0x70\n ? die+0x3d/0x60\n ? do_trap+0xa4/0x110\n ? __list_add_valid_or_report+0x5e/0xb0\n ? do_error_trap+0x6d/0x90\n ? __list_add_valid_or_report+0x5e/0xb0\n ? handle_invalid_op+0x30/0x40\n ? __list_add_valid_or_report+0x5e/0xb0\n ? exc_invalid_op+0x3c/0x50\n ? asm_exc_invalid_op+0x16/0x20\n ? __list_add_valid_or_report+0x5e/0xb0\n rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f]\n drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ? finish_wait+0x3e/0x90\n ? synchronize_rcu_expedited+0x174/0x260\n ? sync_rcu_exp_done_unlocked+0x50/0x50\n ? wake_bit_function+0x40/0x40\n ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n process_scheduled_works+0x1e5/0x480\n worker_thread+0xea/0x1e0\n kthread+0xdb/0x110\n ? move_linked_works+0x90/0x90\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork+0x3b/0x50\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork_asm+0x11/0x20\n \u0026lt;/TASK\u0026gt;\nModules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev\ngsmi: Log Shutdown Reason 0x03\n---[ end trace 0000000000000000 ]---(CVE-2024-49939)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nppp: do not assume bh is held in ppp_channel_bridge_input()\n\nNetworking receive path is usually handled from BH handler.\nHowever, some protocols need to acquire the socket lock, and\npackets might be stored in the socket backlog is the socket was\nowned by a user process.\n\nIn this case, release_sock(), __release_sock(), and sk_backlog_rcv()\nmight call the sk-\u0026gt;sk_backlog_rcv() handler in process context.\n\nsybot caught ppp was not considering this case in\nppp_channel_bridge_input() :\n\nWARNING: inconsistent lock state\n6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted\n--------------------------------\ninconsistent {SOFTIRQ-ON-W} -\u0026gt; {IN-SOFTIRQ-W} usage.\nksoftirqd/1/24 [HC0[0]:SC1[1]:HE1:SE0] takes:\n ffff0000db7f11e0 (\u0026amp;pch-\u0026gt;downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]\n ffff0000db7f11e0 (\u0026amp;pch-\u0026gt;downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]\n ffff0000db7f11e0 (\u0026amp;pch-\u0026gt;downl){+.?.}-{2:2}, at: ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304\n{SOFTIRQ-ON-W} state was registered at:\n   lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759\n   __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]\n   _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154\n   spin_lock include/linux/spinlock.h:351 [inline]\n   ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]\n   ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304\n   pppoe_rcv_core+0xfc/0x314 drivers/net/ppp/pppoe.c:379\n   sk_backlog_rcv include/net/sock.h:1111 [inline]\n   __release_sock+0x1a8/0x3d8 net/core/sock.c:3004\n   release_sock+0x68/0x1b8 net/core/sock.c:3558\n   pppoe_sendmsg+0xc8/0x5d8 drivers/net/ppp/pppoe.c:903\n   sock_sendmsg_nosec net/socket.c:730 [inline]\n   __sock_sendmsg net/socket.c:745 [inline]\n   __sys_sendto+0x374/0x4f4 net/socket.c:2204\n   __do_sys_sendto net/socket.c:2216 [inline]\n   __se_sys_sendto net/socket.c:2212 [inline]\n   __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2212\n   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n   invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n   el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n   do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n   el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712\n   el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n   el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\nirq event stamp: 282914\n hardirqs last  enabled at (282914): [\u0026lt;ffff80008b42e30c\u0026gt;] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]\n hardirqs last  enabled at (282914): [\u0026lt;ffff80008b42e30c\u0026gt;] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194\n hardirqs last disabled at (282913): [\u0026lt;ffff80008b42e13c\u0026gt;] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]\n hardirqs last disabled at (282913): [\u0026lt;ffff80008b42e13c\u0026gt;] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162\n softirqs last  enabled at (282904): [\u0026lt;ffff8000801f8e88\u0026gt;] softirq_handle_end kernel/softirq.c:400 [inline]\n softirqs last  enabled at (282904): [\u0026lt;ffff8000801f8e88\u0026gt;] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582\n softirqs last disabled at (282909): [\u0026lt;ffff8000801fbdf8\u0026gt;] run_ksoftirqd+0x70/0x158 kernel/softirq.c:928\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(\u0026amp;pch-\u0026gt;downl);\n  \u0026lt;Interrupt\u0026gt;\n    lock(\u0026amp;pch-\u0026gt;downl);\n\n *** DEADLOCK ***\n\n1 lock held by ksoftirqd/1/24:\n  #0: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall trace:\n  dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319\n  show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326\n  __dump_sta\n---truncated---(CVE-2024-49946)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix possible crash on mgmt_index_removed\n\nIf mgmt_index_removed is called while there are commands queued on\ncmd_sync it could lead to crashes like the bellow trace:\n\n0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc\n0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth]\n0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth]\n0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth]\n\nSo while handling mgmt_index_removed this attempts to dequeue\ncommands passed as user_data to cmd_sync.(CVE-2024-49951)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice\n\nThe km.state is not checked in driver\u0026apos;s delayed work. When\nxfrm_state_check_expire() is called, the state can be reset to\nXFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This\nhappens when xfrm state is deleted, but not freed yet. As\n__xfrm_state_delete() is called again in xfrm timer, the following\ncrash occurs.\n\nTo fix this issue, skip xfrm_state_check_expire() if km.state is not\nXFRM_STATE_VALID.\n\n Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP\n CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core]\n RIP: 0010:__xfrm_state_delete+0x3d/0x1b0\n Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 \u0026lt;48\u0026gt; 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48\n RSP: 0018:ffff88885f945ec8 EFLAGS: 00010246\n RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036\n RDX: dead000000000100 RSI: 0000000000000000 RDI: ffffffff82afb980\n RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000\n R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246\n R13: ffff888109a20340 R14: ffff88885f95f420 R15: ffff88885f95f400\n FS:  0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f2163102430 CR3: 00000001128d6001 CR4: 0000000000370eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  ? die_addr+0x33/0x90\n  ? exc_general_protection+0x1a2/0x390\n  ? asm_exc_general_protection+0x22/0x30\n  ? __xfrm_state_delete+0x3d/0x1b0\n  ? __xfrm_state_delete+0x2f/0x1b0\n  xfrm_timer_handler+0x174/0x350\n  ? __xfrm_state_delete+0x1b0/0x1b0\n  __hrtimer_run_queues+0x121/0x270\n  hrtimer_run_softirq+0x88/0xd0\n  handle_softirqs+0xcc/0x270\n  do_softirq+0x3c/0x50\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x47/0x50\n  mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core]\n  process_one_work+0x137/0x2d0\n  worker_thread+0x28d/0x3a0\n  ? rescuer_thread+0x480/0x480\n  kthread+0xb8/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n  \u0026lt;/TASK\u0026gt;(CVE-2024-49953)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpftool: Fix undefined behavior in qsort(NULL, 0, ...)\n\nWhen netfilter has no entry to display, qsort is called with\nqsort(NULL, 0, ...). This results in undefined behavior, as UBSan\nreports:\n\nnet.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null\n\nAlthough the C standard does not explicitly state whether calling qsort\nwith a NULL pointer when the size is 0 constitutes undefined behavior,\nSection 7.1.4 of the C standard (Use of library functions) mentions:\n\n\u0026quot;Each of the following statements applies unless explicitly stated\notherwise in the detailed descriptions that follow: If an argument to a\nfunction has an invalid value (such as a value outside the domain of\nthe function, or a pointer outside the address space of the program, or\na null pointer, or a pointer to non-modifiable storage when the\ncorresponding parameter is not const-qualified) or a type (after\npromotion) not expected by a function with variable number of\narguments, the behavior is undefined.\u0026quot;\n\nTo avoid this, add an early return when nf_link_info is NULL to prevent\ncalling qsort with a NULL pointer.(CVE-2024-49987)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add refcnt to ksmbd_conn struct\n\nWhen sending an oplock break request, opinfo-\u0026gt;conn is used,\nBut freed -\u0026gt;conn can be used on multichannel.\nThis patch add a reference count to the ksmbd_conn struct\nso that it can be freed when it is no longer used.(CVE-2024-49988)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \u0026quot;arbitrary runtime\u0026quot; (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-\u0026gt; ...\n   -\u0026gt; dsa_user_phy_read()\n      -\u0026gt; ds-\u0026gt;ops-\u0026gt;phy_read()\n         -\u0026gt; lan9303_phy_read()\n            -\u0026gt; chip-\u0026gt;ops-\u0026gt;phy_read()\n               -\u0026gt; lan9303_mdio_phy_read()\n                  -\u0026gt; dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp-\u0026gt;conduit-\u0026gt;dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev-\u0026gt;dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev-\u0026gt;dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds-\u0026gt;ops-\u0026gt;phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data.  All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit-\u0026gt;dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we\u0026apos;re no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\u0026quot;net: dsa: be compatible with masters which unregister on shutdown\u0026quot;)\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit-\u0026gt;dsa_ptr\n(one which doesn\u0026apos;t ensure that the interfaces aren\u0026apos;t up).(CVE-2024-49998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nppp: fix ppp_async_encode() illegal access\n\nsyzbot reported an issue in ppp_async_encode() [1]\n\nIn this case, pppoe_sendmsg() is called with a zero size.\nThen ppp_async_encode() is called with an empty skb.\n\nBUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n  ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n  ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n  ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634\n  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline]\n  ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304\n  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n  __release_sock+0x1da/0x330 net/core/sock.c:3072\n  release_sock+0x6b/0x250 net/core/sock.c:3626\n  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4092 [inline]\n  slab_alloc_node mm/slub.c:4135 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1322 [inline]\n  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024(CVE-2024-50035)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Fix multiple init when debugfs is disabled\n\nIf bt_debugfs is not created successfully, which happens if either\nCONFIG_DEBUG_FS or CONFIG_DEBUG_FS_ALLOW_ALL is unset, then iso_init()\nreturns early and does not set iso_inited to true. This means that a\nsubsequent call to iso_init() will result in duplicate calls to\nproto_register(), bt_sock_register(), etc.\n\nWith CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION enabled, the\nduplicate call to proto_register() triggers this BUG():\n\n  list_add double add: new=ffffffffc0b280d0, prev=ffffffffbab56250,\n    next=ffffffffc0b280d0.\n  ------------[ cut here ]------------\n  kernel BUG at lib/list_debug.c:35!\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1\n  RIP: 0010:__list_add_valid_or_report+0x9a/0xa0\n  ...\n    __list_add_valid_or_report+0x9a/0xa0\n    proto_register+0x2b5/0x340\n    iso_init+0x23/0x150 [bluetooth]\n    set_iso_socket_func+0x68/0x1b0 [bluetooth]\n    kmem_cache_free+0x308/0x330\n    hci_sock_sendmsg+0x990/0x9e0 [bluetooth]\n    __sock_sendmsg+0x7b/0x80\n    sock_write_iter+0x9a/0x110\n    do_iter_readv_writev+0x11d/0x220\n    vfs_writev+0x180/0x3e0\n    do_writev+0xca/0x100\n  ...\n\nThis change removes the early return. The check for iso_debugfs being\nNULL was unnecessary, it is always NULL when iso_inited is false.(CVE-2024-50077)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error\n\nThe `nouveau_dmem_copy_one` function ensures that the copy push command is\nsent to the device firmware but does not track whether it was executed\nsuccessfully.\n\nIn the case of a copy error (e.g., firmware or hardware failure), the\ncopy push command will be sent via the firmware channel, and\n`nouveau_dmem_copy_one` will likely report success, leading to the\n`migrate_to_ram` function returning a dirty HIGH_USER page to the user.\n\nThis can result in a security vulnerability, as a HIGH_USER page that may\ncontain sensitive or corrupted data could be returned to the user.\n\nTo prevent this vulnerability, we allocate a zero page. Thus, in case of\nan error, a non-dirty (zero) page will be returned to the user.(CVE-2024-50096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix one more kernel-infoleak in algo dumping\n\nDuring fuzz testing, the following issue was discovered:\n\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30\n _copy_to_iter+0x598/0x2a30\n __skb_datagram_iter+0x168/0x1060\n skb_copy_datagram_iter+0x5b/0x220\n netlink_recvmsg+0x362/0x1700\n sock_recvmsg+0x2dc/0x390\n __sys_recvfrom+0x381/0x6d0\n __x64_sys_recvfrom+0x130/0x200\n x64_sys_call+0x32c8/0x3cc0\n do_syscall_64+0xd8/0x1c0\n entry_SYSCALL_64_after_hwframe+0x79/0x81\n\nUninit was stored to memory at:\n copy_to_user_state_extra+0xcc1/0x1e00\n dump_one_state+0x28c/0x5f0\n xfrm_state_walk+0x548/0x11e0\n xfrm_dump_sa+0x1e0/0x840\n netlink_dump+0x943/0x1c40\n __netlink_dump_start+0x746/0xdb0\n xfrm_user_rcv_msg+0x429/0xc00\n netlink_rcv_skb+0x613/0x780\n xfrm_netlink_rcv+0x77/0xc0\n netlink_unicast+0xe90/0x1280\n netlink_sendmsg+0x126d/0x1490\n __sock_sendmsg+0x332/0x3d0\n ____sys_sendmsg+0x863/0xc30\n ___sys_sendmsg+0x285/0x3e0\n __x64_sys_sendmsg+0x2d6/0x560\n x64_sys_call+0x1316/0x3cc0\n do_syscall_64+0xd8/0x1c0\n entry_SYSCALL_64_after_hwframe+0x79/0x81\n\nUninit was created at:\n __kmalloc+0x571/0xd30\n attach_auth+0x106/0x3e0\n xfrm_add_sa+0x2aa0/0x4230\n xfrm_user_rcv_msg+0x832/0xc00\n netlink_rcv_skb+0x613/0x780\n xfrm_netlink_rcv+0x77/0xc0\n netlink_unicast+0xe90/0x1280\n netlink_sendmsg+0x126d/0x1490\n __sock_sendmsg+0x332/0x3d0\n ____sys_sendmsg+0x863/0xc30\n ___sys_sendmsg+0x285/0x3e0\n __x64_sys_sendmsg+0x2d6/0x560\n x64_sys_call+0x1316/0x3cc0\n do_syscall_64+0xd8/0x1c0\n entry_SYSCALL_64_after_hwframe+0x79/0x81\n\nBytes 328-379 of 732 are uninitialized\nMemory access of size 732 starts at ffff88800e18e000\nData copied to user address 00007ff30f48aff0\n\nCPU: 2 PID: 18167 Comm: syz-executor.0 Not tainted 6.8.11 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n\nFixes copying of xfrm algorithms where some random\ndata of the structure fields can end up in userspace.\nPadding in structures may be filled with random (possibly sensitve)\ndata and should never be given directly to user-space.\n\nA similar issue was resolved in the commit\n8222d5910dae (\u0026quot;xfrm: Zero padding when dumping algos and encap\u0026quot;)\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2024-50110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Enable IRQ if do_ale() triggered in irq-enabled context\n\nUnaligned access exception can be triggered in irq-enabled context such\nas user mode, in this case do_ale() may call get_user() which may cause\nsleep. Then we will get:\n\n BUG: sleeping function called from invalid context at arch/loongarch/kernel/access-helper.h:7\n in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 129, name: modprobe\n preempt_count: 0, expected: 0\n RCU nest depth: 0, expected: 0\n CPU: 0 UID: 0 PID: 129 Comm: modprobe Tainted: G        W          6.12.0-rc1+ #1723\n Tainted: [W]=WARN\n Stack : 9000000105e0bd48 0000000000000000 9000000003803944 9000000105e08000\n         9000000105e0bc70 9000000105e0bc78 0000000000000000 0000000000000000\n         9000000105e0bc78 0000000000000001 9000000185e0ba07 9000000105e0b890\n         ffffffffffffffff 9000000105e0bc78 73924b81763be05b 9000000100194500\n         000000000000020c 000000000000000a 0000000000000000 0000000000000003\n         00000000000023f0 00000000000e1401 00000000072f8000 0000007ffbb0e260\n         0000000000000000 0000000000000000 9000000005437650 90000000055d5000\n         0000000000000000 0000000000000003 0000007ffbb0e1f0 0000000000000000\n         0000005567b00490 0000000000000000 9000000003803964 0000007ffbb0dfec\n         00000000000000b0 0000000000000007 0000000000000003 0000000000071c1d\n         ...\n Call Trace:\n [\u0026lt;9000000003803964\u0026gt;] show_stack+0x64/0x1a0\n [\u0026lt;9000000004c57464\u0026gt;] dump_stack_lvl+0x74/0xb0\n [\u0026lt;9000000003861ab4\u0026gt;] __might_resched+0x154/0x1a0\n [\u0026lt;900000000380c96c\u0026gt;] emulate_load_store_insn+0x6c/0xf60\n [\u0026lt;9000000004c58118\u0026gt;] do_ale+0x78/0x180\n [\u0026lt;9000000003801bc8\u0026gt;] handle_ale+0x128/0x1e0\n\nSo enable IRQ if unaligned access exception is triggered in irq-enabled\ncontext to fix it.(CVE-2024-50111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Unregister notifier on eswitch init failure\n\nIt otherwise remains registered and a subsequent attempt at eswitch\nenabling might trigger warnings of the sort:\n\n[  682.589148] ------------[ cut here ]------------\n[  682.590204] notifier callback eswitch_vport_event [mlx5_core] already registered\n[  682.590256] WARNING: CPU: 13 PID: 2660 at kernel/notifier.c:31 notifier_chain_register+0x3e/0x90\n[...snipped]\n[  682.610052] Call Trace:\n[  682.610369]  \u0026lt;TASK\u0026gt;\n[  682.610663]  ? __warn+0x7c/0x110\n[  682.611050]  ? notifier_chain_register+0x3e/0x90\n[  682.611556]  ? report_bug+0x148/0x170\n[  682.611977]  ? handle_bug+0x36/0x70\n[  682.612384]  ? exc_invalid_op+0x13/0x60\n[  682.612817]  ? asm_exc_invalid_op+0x16/0x20\n[  682.613284]  ? notifier_chain_register+0x3e/0x90\n[  682.613789]  atomic_notifier_chain_register+0x25/0x40\n[  682.614322]  mlx5_eswitch_enable_locked+0x1d4/0x3b0 [mlx5_core]\n[  682.614965]  mlx5_eswitch_enable+0xc9/0x100 [mlx5_core]\n[  682.615551]  mlx5_device_enable_sriov+0x25/0x340 [mlx5_core]\n[  682.616170]  mlx5_core_sriov_configure+0x50/0x170 [mlx5_core]\n[  682.616789]  sriov_numvfs_store+0xb0/0x1b0\n[  682.617248]  kernfs_fop_write_iter+0x117/0x1a0\n[  682.617734]  vfs_write+0x231/0x3f0\n[  682.618138]  ksys_write+0x63/0xe0\n[  682.618536]  do_syscall_64+0x4c/0x100\n[  682.618958]  entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2024-50136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix command bitmask initialization\n\nCommand bitmask have a dedicated bit for MANAGE_PAGES command, this bit\nisn\u0026apos;t Initialize during command bitmask Initialization, only during\nMANAGE_PAGES.\n\nIn addition, mlx5_cmd_trigger_completions() is trying to trigger\ncompletion for MANAGE_PAGES command as well.\n\nHence, in case health error occurred before any MANAGE_PAGES command\nhave been invoke (for example, during mlx5_enable_hca()),\nmlx5_cmd_trigger_completions() will try to trigger completion for\nMANAGE_PAGES command, which will result in null-ptr-deref error.[1]\n\nFix it by Initialize command bitmask correctly.\n\nWhile at it, re-write the code for better understanding.\n\n[1]\nBUG: KASAN: null-ptr-deref in mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]\nWrite of size 4 at addr 0000000000000214 by task kworker/u96:2/12078\nCPU: 10 PID: 12078 Comm: kworker/u96:2 Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nWorkqueue: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x7e/0xc0\n kasan_report+0xb9/0xf0\n kasan_check_range+0xec/0x190\n mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]\n mlx5_cmd_flush+0x94/0x240 [mlx5_core]\n enter_error_state+0x6c/0xd0 [mlx5_core]\n mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core]\n process_one_work+0x787/0x1490\n ? lockdep_hardirqs_on_prepare+0x400/0x400\n ? pwq_dec_nr_in_flight+0xda0/0xda0\n ? assign_work+0x168/0x240\n worker_thread+0x586/0xd30\n ? rescuer_thread+0xae0/0xae0\n kthread+0x2df/0x3b0\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x2d/0x70\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork_asm+0x11/0x20\n \u0026lt;/TASK\u0026gt;(CVE-2024-50147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs8409: Fix possible NULL dereference\n\nIf snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then\nNULL pointer dereference will occur in the next line.\n\nSince dolphin_fixups function is a hda_fixup function which is not supposed\nto return any errors, add simple check before dereference, ignore the fail.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-50160)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: qcom: camss: Remove use_count guard in stop_streaming\n\nThe use_count check was introduced so that multiple concurrent Raw Data\nInterfaces RDIs could be driven by different virtual channels VCs on the\nCSIPHY input driving the video pipeline.\n\nThis is an invalid use of use_count though as use_count pertains to the\nnumber of times a video entity has been opened by user-space not the number\nof active streams.\n\nIf use_count and stream-on count don\u0026apos;t agree then stop_streaming() will\nbreak as is currently the case and has become apparent when using CAMSS\nwith libcamera\u0026apos;s released softisp 0.3.\n\nThe use of use_count like this is a bit hacky and right now breaks regular\nusage of CAMSS for a single stream case. Stopping qcam results in the splat\nbelow, and then it cannot be started again and any attempts to do so fails\nwith -EBUSY.\n\n[ 1265.509831] WARNING: CPU: 5 PID: 919 at drivers/media/common/videobuf2/videobuf2-core.c:2183 __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]\n...\n[ 1265.510630] Call trace:\n[ 1265.510636]  __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]\n[ 1265.510648]  vb2_core_streamoff+0x24/0xcc [videobuf2_common]\n[ 1265.510660]  vb2_ioctl_streamoff+0x5c/0xa8 [videobuf2_v4l2]\n[ 1265.510673]  v4l_streamoff+0x24/0x30 [videodev]\n[ 1265.510707]  __video_do_ioctl+0x190/0x3f4 [videodev]\n[ 1265.510732]  video_usercopy+0x304/0x8c4 [videodev]\n[ 1265.510757]  video_ioctl2+0x18/0x34 [videodev]\n[ 1265.510782]  v4l2_ioctl+0x40/0x60 [videodev]\n...\n[ 1265.510944] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 0 in active state\n[ 1265.511175] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 1 in active state\n[ 1265.511398] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 2 in active st\n\nOne CAMSS specific way to handle multiple VCs on the same RDI might be:\n\n- Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx.\n- The video buffers are already associated with msm_vfeN_rdiX so\n  release video buffers when told to do so by stop_streaming.\n- Only release the power-domains for the CSIPHY, CSID and VFE when\n  their internal refcounts drop.\n\nEither way refusing to release video buffers based on use_count is\nerroneous and should be reverted. The silicon enabling code for selecting\nVCs is perfectly fine. Its a \u0026quot;known missing feature\u0026quot; that concurrent VCs\nwon\u0026apos;t work with CAMSS right now.\n\nInitial testing with this code didn\u0026apos;t show an error but, SoftISP and \u0026quot;real\u0026quot;\nusage with Google Hangouts breaks the upstream code pretty quickly, we need\nto do a partial revert and take another pass at VCs.\n\nThis commit partially reverts commit 89013969e232 (\u0026quot;media: camss: sm8250:\nPipeline starting and stopping for multiple virtual channels\u0026quot;)(CVE-2024-50175)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: k3-r5: Fix error handling when power-up failed\n\nBy simply bailing out, the driver was violating its rule and internal\nassumptions that either both or no rproc should be initialized. E.g.,\nthis could cause the first core to be available but not the second one,\nleading to crashes on its shutdown later on while trying to dereference\nthat second instance.(CVE-2024-50176)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D\n\nFor i.MX7D DRAM related mux clock, the clock source change should ONLY\nbe done done in low level asm code without accessing DRAM, and then\ncalling clk API to sync the HW clock status with clk tree, it should never\ntouch real clock source switch via clk API, so CLK_SET_PARENT_GATE flag\nshould NOT be added, otherwise, DRAM\u0026apos;s clock parent will be disabled when\nDRAM is active, and system will hang.(CVE-2024-50181)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance\n\nDeleting an NPIV instance requires all fabric ndlps to be released before\nan NPIV\u0026apos;s resources can be torn down.  Failure to release fabric ndlps\nbeforehand opens kref imbalance race conditions.  Fix by forcing the DA_ID\nto complete synchronously with usage of wait_queue.(CVE-2024-50183)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Switch to device-managed dmam_alloc_coherent()\n\nUsing the device-managed version allows to simplify clean-up in probe()\nerror path.\n\nAdditionally, this device-managed ensures proper cleanup, which helps to\nresolve memory errors, page faults, btrfs going read-only, and btrfs\ndisk corruption.(CVE-2024-50189)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfork: do not invoke uffd on fork if error occurs\n\nPatch series \u0026quot;fork: do not expose incomplete mm on fork\u0026quot;.\n\nDuring fork we may place the virtual memory address space into an\ninconsistent state before the fork operation is complete.\n\nIn addition, we may encounter an error during the fork operation that\nindicates that the virtual memory address space is invalidated.\n\nAs a result, we should not be exposing it in any way to external machinery\nthat might interact with the mm or VMAs, machinery that is not designed to\ndeal with incomplete state.\n\nWe specifically update the fork logic to defer khugepaged and ksm to the\nend of the operation and only to be invoked if no error arose, and\ndisallow uffd from observing fork events should an error have occurred.\n\n\nThis patch (of 2):\n\nCurrently on fork we expose the virtual address space of a process to\nuserland unconditionally if uffd is registered in VMAs, regardless of\nwhether an error arose in the fork.\n\nThis is performed in dup_userfaultfd_complete() which is invoked\nunconditionally, and performs two duties - invoking registered handlers\nfor the UFFD_EVENT_FORK event via dup_fctx(), and clearing down\nuserfaultfd_fork_ctx objects established in dup_userfaultfd().\n\nThis is problematic, because the virtual address space may not yet be\ncorrectly initialised if an error arose.\n\nThe change in commit d24062914837 (\u0026quot;fork: use __mt_dup() to duplicate\nmaple tree in dup_mmap()\u0026quot;) makes this more pertinent as we may be in a\nstate where entries in the maple tree are not yet consistent.\n\nWe address this by, on fork error, ensuring that we roll back state that\nwe would otherwise expect to clean up through the event being handled by\nuserland and perform the memory freeing duty otherwise performed by\ndup_userfaultfd_complete().\n\nWe do this by implementing a new function, dup_userfaultfd_fail(), which\nperforms the same loop, only decrementing reference counts.\n\nNote that we perform mmgrab() on the parent and child mm\u0026apos;s, however\nuserfaultfd_ctx_put() will mmdrop() this once the reference count drops to\nzero, so we will avoid memory leaks correctly here.(CVE-2024-50220)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Vangogh: Fix kernel memory out of bounds write\n\nKASAN reports that the GPU metrics table allocated in\nvangogh_tables_init() is not large enough for the memset done in\nsmu_cmn_init_soft_gpu_metrics(). Condensed report follows:\n\n[   33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]\n[   33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067\n...\n[   33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G        W          6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544\n[   33.861816] Tainted: [W]=WARN\n[   33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023\n[   33.861822] Call Trace:\n[   33.861826]  \u0026lt;TASK\u0026gt;\n[   33.861829]  dump_stack_lvl+0x66/0x90\n[   33.861838]  print_report+0xce/0x620\n[   33.861853]  kasan_report+0xda/0x110\n[   33.862794]  kasan_check_range+0xfd/0x1a0\n[   33.862799]  __asan_memset+0x23/0x40\n[   33.862803]  smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.863306]  vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.864257]  vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.865682]  amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.866160]  amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.867135]  dev_attr_show+0x43/0xc0\n[   33.867147]  sysfs_kf_seq_show+0x1f1/0x3b0\n[   33.867155]  seq_read_iter+0x3f8/0x1140\n[   33.867173]  vfs_read+0x76c/0xc50\n[   33.867198]  ksys_read+0xfb/0x1d0\n[   33.867214]  do_syscall_64+0x90/0x160\n...\n[   33.867353] Allocated by task 378 on cpu 7 at 22.794876s:\n[   33.867358]  kasan_save_stack+0x33/0x50\n[   33.867364]  kasan_save_track+0x17/0x60\n[   33.867367]  __kasan_kmalloc+0x87/0x90\n[   33.867371]  vangogh_init_smc_tables+0x3f9/0x840 [amdgpu]\n[   33.867835]  smu_sw_init+0xa32/0x1850 [amdgpu]\n[   33.868299]  amdgpu_device_init+0x467b/0x8d90 [amdgpu]\n[   33.868733]  amdgpu_driver_load_kms+0x19/0xf0 [amdgpu]\n[   33.869167]  amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu]\n[   33.869608]  local_pci_probe+0xda/0x180\n[   33.869614]  pci_device_probe+0x43f/0x6b0\n\nEmpirically we can confirm that the former allocates 152 bytes for the\ntable, while the latter memsets the 168 large block.\n\nRoot cause appears that when GPU metrics tables for v2_4 parts were added\nit was not considered to enlarge the table to fit.\n\nThe fix in this patch is rather \u0026quot;brute force\u0026quot; and perhaps later should be\ndone in a smarter way, by extracting and consolidating the part version to\nsize logic to a common helper, instead of brute forcing the largest\npossible allocation. Nevertheless, for now this works and fixes the out of\nbounds write.\n\nv2:\n * Drop impossible v3_0 case. (Mario)\n\n(cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)(CVE-2024-50221)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()\n\nmodprobe iio-test-gts and rmmod it, then the following memory leak\noccurs:\n\n\tunreferenced object 0xffffff80c810be00 (size 64):\n\t  comm \u0026quot;kunit_try_catch\u0026quot;, pid 1654, jiffies 4294913981\n\t  hex dump (first 32 bytes):\n\t    02 00 00 00 08 00 00 00 20 00 00 00 40 00 00 00  ........ ...@...\n\t    80 00 00 00 00 02 00 00 00 04 00 00 00 08 00 00  ................\n\t  backtrace (crc a63d875e):\n\t    [\u0026lt;0000000028c1b3c2\u0026gt;] kmemleak_alloc+0x34/0x40\n\t    [\u0026lt;000000001d6ecc87\u0026gt;] __kmalloc_noprof+0x2bc/0x3c0\n\t    [\u0026lt;00000000393795c1\u0026gt;] devm_iio_init_iio_gts+0x4b4/0x16f4\n\t    [\u0026lt;0000000071bb4b09\u0026gt;] 0xffffffdf052a62e0\n\t    [\u0026lt;000000000315bc18\u0026gt;] 0xffffffdf052a6488\n\t    [\u0026lt;00000000f9dc55b5\u0026gt;] kunit_try_run_case+0x13c/0x3ac\n\t    [\u0026lt;00000000175a3fd4\u0026gt;] kunit_generic_run_threadfn_adapter+0x80/0xec\n\t    [\u0026lt;00000000f505065d\u0026gt;] kthread+0x2e8/0x374\n\t    [\u0026lt;00000000bbfb0e5d\u0026gt;] ret_from_fork+0x10/0x20\n\tunreferenced object 0xffffff80cbfe9e70 (size 16):\n\t  comm \u0026quot;kunit_try_catch\u0026quot;, pid 1658, jiffies 4294914015\n\t  hex dump (first 16 bytes):\n\t    10 00 00 00 40 00 00 00 80 00 00 00 00 00 00 00  ....@...........\n\t  backtrace (crc 857f0cb4):\n\t    [\u0026lt;0000000028c1b3c2\u0026gt;] kmemleak_alloc+0x34/0x40\n\t    [\u0026lt;000000001d6ecc87\u0026gt;] __kmalloc_noprof+0x2bc/0x3c0\n\t    [\u0026lt;00000000393795c1\u0026gt;] devm_iio_init_iio_gts+0x4b4/0x16f4\n\t    [\u0026lt;0000000071bb4b09\u0026gt;] 0xffffffdf052a62e0\n\t    [\u0026lt;000000007d089d45\u0026gt;] 0xffffffdf052a6864\n\t    [\u0026lt;00000000f9dc55b5\u0026gt;] kunit_try_run_case+0x13c/0x3ac\n\t    [\u0026lt;00000000175a3fd4\u0026gt;] kunit_generic_run_threadfn_adapter+0x80/0xec\n\t    [\u0026lt;00000000f505065d\u0026gt;] kthread+0x2e8/0x374\n\t    [\u0026lt;00000000bbfb0e5d\u0026gt;] ret_from_fork+0x10/0x20\n\t......\n\nIt includes 5*5 times \u0026quot;size 64\u0026quot; memory leaks, which correspond to 5 times\ntest_init_iio_gain_scale() calls with gts_test_gains size 10 (10*size(int))\nand gts_test_itimes size 5. It also includes 5*1 times \u0026quot;size 16\u0026quot;\nmemory leak, which correspond to one time __test_init_iio_gain_scale()\ncall with gts_test_gains_gain_low size 3 (3*size(int)) and gts_test_itimes\nsize 5.\n\nThe reason is that the per_time_gains[i] is not freed which is allocated in\nthe \u0026quot;gts-\u0026gt;num_itime\u0026quot; for loop in iio_gts_build_avail_scale_table().(CVE-2024-50231)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()\n\nIn the ad7124_write_raw() function, parameter val can potentially\nbe zero. This may lead to a division by zero when DIV_ROUND_CLOSEST()\nis called within ad7124_set_channel_odr(). The ad7124_write_raw()\nfunction is invoked through the sequence: iio_write_channel_raw() -\u0026gt;\niio_write_channel_attribute() -\u0026gt; iio_channel_write(), with no checks\nin place to ensure val is non-zero.(CVE-2024-50232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nphy: qcom: qmp-usb: fix NULL-deref on runtime suspend\n\nCommit 413db06c05e7 (\u0026quot;phy: qcom-qmp-usb: clean up probe initialisation\u0026quot;)\nremoved most users of the platform device driver data, but mistakenly\nalso removed the initialisation despite the data still being used in the\nruntime PM callbacks.\n\nRestore the driver data initialisation at probe to avoid a NULL-pointer\ndereference on runtime suspend.\n\nApparently no one uses runtime PM, which currently needs to be enabled\nmanually through sysfs, with this driver.(CVE-2024-50240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address\n\nThe device stores IPv6 addresses that are used for encapsulation in\nlinear memory that is managed by the driver.\n\nChanging the remote address of an ip6gre net device never worked\nproperly, but since cited commit the following reproducer [1] would\nresult in a warning [2] and a memory leak [3]. The problem is that the\nnew remote address is never added by the driver to its hash table (and\ntherefore the device) and the old address is never removed from it.\n\nFix by programming the new address when the configuration of the ip6gre\nnet device changes and removing the old one. If the address did not\nchange, then the above would result in increasing the reference count of\nthe address and then decreasing it.\n\n[1]\n # ip link add name bla up type ip6gre local 2001:db8:1::1 remote 2001:db8:2::1 tos inherit ttl inherit\n # ip link set dev bla type ip6gre remote 2001:db8:3::1\n # ip link del dev bla\n # devlink dev reload pci/0000:01:00.0\n\n[2]\nWARNING: CPU: 0 PID: 1682 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3002 mlxsw_sp_ipv6_addr_put+0x140/0x1d0\nModules linked in:\nCPU: 0 UID: 0 PID: 1682 Comm: ip Not tainted 6.12.0-rc3-custom-g86b5b55bc835 #151\nHardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023\nRIP: 0010:mlxsw_sp_ipv6_addr_put+0x140/0x1d0\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlxsw_sp_router_netdevice_event+0x55f/0x1240\n notifier_call_chain+0x5a/0xd0\n call_netdevice_notifiers_info+0x39/0x90\n unregister_netdevice_many_notify+0x63e/0x9d0\n rtnl_dellink+0x16b/0x3a0\n rtnetlink_rcv_msg+0x142/0x3f0\n netlink_rcv_skb+0x50/0x100\n netlink_unicast+0x242/0x390\n netlink_sendmsg+0x1de/0x420\n ____sys_sendmsg+0x2bd/0x320\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xd0\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[3]\nunreferenced object 0xffff898081f597a0 (size 32):\n  comm \u0026quot;ip\u0026quot;, pid 1626, jiffies 4294719324\n  hex dump (first 32 bytes):\n    20 01 0d b8 00 02 00 00 00 00 00 00 00 00 00 01   ...............\n    21 49 61 83 80 89 ff ff 00 00 00 00 01 00 00 00  !Ia.............\n  backtrace (crc fd9be911):\n    [\u0026lt;00000000df89c55d\u0026gt;] __kmalloc_cache_noprof+0x1da/0x260\n    [\u0026lt;00000000ff2a1ddb\u0026gt;] mlxsw_sp_ipv6_addr_kvdl_index_get+0x281/0x340\n    [\u0026lt;000000009ddd445d\u0026gt;] mlxsw_sp_router_netdevice_event+0x47b/0x1240\n    [\u0026lt;00000000743e7757\u0026gt;] notifier_call_chain+0x5a/0xd0\n    [\u0026lt;000000007c7b9e13\u0026gt;] call_netdevice_notifiers_info+0x39/0x90\n    [\u0026lt;000000002509645d\u0026gt;] register_netdevice+0x5f7/0x7a0\n    [\u0026lt;00000000c2e7d2a9\u0026gt;] ip6gre_newlink_common.isra.0+0x65/0x130\n    [\u0026lt;0000000087cd6d8d\u0026gt;] ip6gre_newlink+0x72/0x120\n    [\u0026lt;000000004df7c7cc\u0026gt;] rtnl_newlink+0x471/0xa20\n    [\u0026lt;0000000057ed632a\u0026gt;] rtnetlink_rcv_msg+0x142/0x3f0\n    [\u0026lt;0000000032e0d5b5\u0026gt;] netlink_rcv_skb+0x50/0x100\n    [\u0026lt;00000000908bca63\u0026gt;] netlink_unicast+0x242/0x390\n    [\u0026lt;00000000cdbe1c87\u0026gt;] netlink_sendmsg+0x1de/0x420\n    [\u0026lt;0000000011db153e\u0026gt;] ____sys_sendmsg+0x2bd/0x320\n    [\u0026lt;000000003b6d53eb\u0026gt;] ___sys_sendmsg+0x9a/0xe0\n    [\u0026lt;00000000cae27c62\u0026gt;] __sys_sendmsg+0x7a/0xd0(CVE-2024-50252)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()\n\nI got a syzbot report without a repro [1] crashing in nf_send_reset6()\n\nI think the issue is that dev-\u0026gt;hard_header_len is zero, and we attempt\nlater to push an Ethernet header.\n\nUse LL_MAX_HEADER, as other functions in net/ipv6/netfilter/nf_reject_ipv6.c.\n\n[1]\n\nskbuff: skb_under_panic: text:ffffffff89b1d008 len:74 put:14 head:ffff88803123aa00 data:ffff88803123a9f2 tail:0x3c end:0x140 dev:syz_tun\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 7373 Comm: syz.1.568 Not tainted 6.12.0-rc2-syzkaller-00631-g6d858708d465 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0d 8d 48 c7 c6 60 a6 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 ba 30 38 02 48 83 c4 20 90 \u0026lt;0f\u0026gt; 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc900045269b0 EFLAGS: 00010282\nRAX: 0000000000000088 RBX: dffffc0000000000 RCX: cd66dacdc5d8e800\nRDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000\nRBP: ffff88802d39a3d0 R08: ffffffff8174afec R09: 1ffff920008a4ccc\nR10: dffffc0000000000 R11: fffff520008a4ccd R12: 0000000000000140\nR13: ffff88803123aa00 R14: ffff88803123a9f2 R15: 000000000000003c\nFS:  00007fdbee5ff6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000005d322000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  eth_header+0x38/0x1f0 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3208 [inline]\n  nf_send_reset6+0xce6/0x1270 net/ipv6/netfilter/nf_reject_ipv6.c:358\n  nft_reject_inet_eval+0x3b9/0x690 net/netfilter/nft_reject_inet.c:48\n  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n  nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288\n  nft_do_chain_inet+0x418/0x6b0 net/netfilter/nft_chain_filter.c:161\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626\n  nf_hook include/linux/netfilter.h:269 [inline]\n  NF_HOOK include/linux/netfilter.h:312 [inline]\n  br_nf_pre_routing_ipv6+0x63e/0x770 net/bridge/br_netfilter_ipv6.c:184\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]\n  br_handle_frame+0x9fd/0x1530 net/bridge/br_input.c:424\n  __netif_receive_skb_core+0x13e8/0x4570 net/core/dev.c:5562\n  __netif_receive_skb_one_core net/core/dev.c:5666 [inline]\n  __netif_receive_skb+0x12f/0x650 net/core/dev.c:5781\n  netif_receive_skb_internal net/core/dev.c:5867 [inline]\n  netif_receive_skb+0x1e8/0x890 net/core/dev.c:5926\n  tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550\n  tun_get_user+0x3056/0x47e0 drivers/net/tun.c:2007\n  tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053\n  new_sync_write fs/read_write.c:590 [inline]\n  vfs_write+0xa6d/0xc90 fs/read_write.c:683\n  ksys_write+0x183/0x2b0 fs/read_write.c:736\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdbeeb7d1ff\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48\nRSP: 002b:00007fdbee5ff000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007fdbeed36058 RCX: 00007fdbeeb7d1ff\nRDX: 000000000000008e RSI: 0000000020000040 RDI: 00000000000000c8\nRBP: 00007fdbeebf12be R08: 0000000\n---truncated---(CVE-2024-50256)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: arc: fix the device for dma_map_single/dma_unmap_single\n\nThe ndev-\u0026gt;dev and pdev-\u0026gt;dev aren\u0026apos;t the same device, use ndev-\u0026gt;dev.parent\nwhich has dma_mask, ndev-\u0026gt;dev.parent is just pdev-\u0026gt;dev.\nOr it would cause the following issue:\n\n[   39.933526] ------------[ cut here ]------------\n[   39.938414] WARNING: CPU: 1 PID: 501 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x90/0x1f8(CVE-2024-50295)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix kernel crash when uninstalling driver\n\nWhen the driver is uninstalled and the VF is disabled concurrently, a\nkernel crash occurs. The reason is that the two actions call function\npci_disable_sriov(). The num_VFs is checked to determine whether to\nrelease the corresponding resources. During the second calling, num_VFs\nis not 0 and the resource release function is called. However, the\ncorresponding resource has been released during the first invoking.\nTherefore, the problem occurs:\n\n[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020\n...\n[15278.131557][T50670] Call trace:\n[15278.134686][T50670]  klist_put+0x28/0x12c\n[15278.138682][T50670]  klist_del+0x14/0x20\n[15278.142592][T50670]  device_del+0xbc/0x3c0\n[15278.146676][T50670]  pci_remove_bus_device+0x84/0x120\n[15278.151714][T50670]  pci_stop_and_remove_bus_device+0x6c/0x80\n[15278.157447][T50670]  pci_iov_remove_virtfn+0xb4/0x12c\n[15278.162485][T50670]  sriov_disable+0x50/0x11c\n[15278.166829][T50670]  pci_disable_sriov+0x24/0x30\n[15278.171433][T50670]  hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]\n[15278.178039][T50670]  hclge_exit+0x28/0xd0 [hclge]\n[15278.182730][T50670]  __se_sys_delete_module.isra.0+0x164/0x230\n[15278.188550][T50670]  __arm64_sys_delete_module+0x1c/0x30\n[15278.193848][T50670]  invoke_syscall+0x50/0x11c\n[15278.198278][T50670]  el0_svc_common.constprop.0+0x158/0x164\n[15278.203837][T50670]  do_el0_svc+0x34/0xcc\n[15278.207834][T50670]  el0_svc+0x20/0x30\n\nFor details, see the following figure.\n\n     rmmod hclge              disable VFs\n----------------------------------------------------\nhclge_exit()            sriov_numvfs_store()\n  ...                     device_lock()\n  pci_disable_sriov()     hns3_pci_sriov_configure()\n                            pci_disable_sriov()\n                              sriov_disable()\n    sriov_disable()             if !num_VFs :\n      if !num_VFs :               return;\n        return;                 sriov_del_vfs()\n      sriov_del_vfs()             ...\n        ...                       klist_put()\n        klist_put()               ...\n        ...                     num_VFs = 0;\n      num_VFs = 0;        device_unlock();\n\nIn this patch, when driver is removing, we get the device_lock()\nto protect num_VFs, just like sriov_numvfs_store().(CVE-2024-50296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()\n\nThe per-netns IP tunnel hash table is protected by the RTNL mutex and\nip_tunnel_find() is only called from the control path where the mutex is\ntaken.\n\nAdd a lockdep expression to hlist_for_each_entry_rcu() in\nip_tunnel_find() in order to validate that the mutex is held and to\nsilence the suspicious RCU usage warning [1].\n\n[1]\nWARNING: suspicious RCU usage\n6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted\n-----------------------------\nnet/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by ip/362:\n #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60\n\nstack backtrace:\nCPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xba/0x110\n lockdep_rcu_suspicious.cold+0x4f/0xd6\n ip_tunnel_find+0x435/0x4d0\n ip_tunnel_newlink+0x517/0x7a0\n ipgre_newlink+0x14c/0x170\n __rtnl_newlink+0x1173/0x19c0\n rtnl_newlink+0x6c/0xa0\n rtnetlink_rcv_msg+0x3cc/0xf60\n netlink_rcv_skb+0x171/0x450\n netlink_unicast+0x539/0x7f0\n netlink_sendmsg+0x8c1/0xd80\n ____sys_sendmsg+0x8f9/0xc20\n ___sys_sendmsg+0x197/0x1e0\n __sys_sendmsg+0x122/0x1f0\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-50304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in intel_hdcp_get_capability\n\nSometimes during hotplug scenario or suspend/resume scenario encoder is\nnot always initialized when intel_hdcp_get_capability add\na check to avoid kernel null pointer dereference.(CVE-2024-53051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n    dma_desc[N + 0],\n    dma_desc[N + 1],\n    dma_desc[N + 2].\nThen three elements of tx_q-\u0026gt;tx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n    tx_q-\u0026gt;tx_skbuff_dma[N + 0],\n    tx_q-\u0026gt;tx_skbuff_dma[N + 1],\n    tx_q-\u0026gt;tx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u0026gt;tx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u0026gt;tx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u0026gt;tx_skbuff_dma[entry].buf is:\n    tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf = NULL;\n    tx_q-\u0026gt;tx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u0026gt;tx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n    tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf = dma_map_single();\n    tx_q-\u0026gt;tx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u0026gt;tx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u0026gt;tx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a(CVE-2024-53058)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx\n\nAs the introduction of the support for vsock and unix sockets in sockmap,\ntls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK.\nvsock and af_unix sockets have vsock_sock and unix_sock instead of\ninet_connection_sock. For these sockets, tls_get_ctx may return an invalid\npointer and cause page fault in function tls_sw_ctx_rx.\n\nBUG: unable to handle page fault for address: 0000000000040030\nWorkqueue: vsock-loopback vsock_loopback_work\nRIP: 0010:sk_psock_strp_data_ready+0x23/0x60\nCall Trace:\n ? __die+0x81/0xc3\n ? no_context+0x194/0x350\n ? do_page_fault+0x30/0x110\n ? async_page_fault+0x3e/0x50\n ? sk_psock_strp_data_ready+0x23/0x60\n virtio_transport_recv_pkt+0x750/0x800\n ? update_load_avg+0x7e/0x620\n vsock_loopback_work+0xd0/0x100\n process_one_work+0x1a7/0x360\n worker_thread+0x30/0x390\n ? create_worker+0x1a0/0x1a0\n kthread+0x112/0x130\n ? __kthread_cancel_work+0x40/0x40\n ret_from_fork+0x1f/0x40\n\nv2:\n  - Add IS_ICSK check\nv3:\n  - Update the commits in Fixes(CVE-2024-53091)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: defer partition scanning\n\nWe need to suppress the partition scan from occuring within the\ncontroller\u0026apos;s scan_work context. If a path error occurs here, the IO will\nwait until a path becomes available or all paths are torn down, but that\naction also occurs within scan_work, so it would deadlock. Defer the\npartion scan to a different context that does not block scan_work.(CVE-2024-53093)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES\n\nWhile running ISER over SIW, the initiator machine encounters a warning\nfrom skb_splice_from_iter() indicating that a slab page is being used in\nsend_page. To address this, it is better to add a sendpage_ok() check\nwithin the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag\nshould be disabled before entering the network stack.\n\nA similar issue has been discussed for NVMe in this thread:\nhttps://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/\n\n  WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320\n  Call Trace:\n   tcp_sendmsg_locked+0x368/0xe40\n   siw_tx_hdt+0x695/0xa40 [siw]\n   siw_qp_sq_process+0x102/0xb00 [siw]\n   siw_sq_resume+0x39/0x110 [siw]\n   siw_run_sq+0x74/0x160 [siw]\n   kthread+0xd2/0x100\n   ret_from_fork+0x34/0x40\n   ret_from_fork_asm+0x1a/0x30(CVE-2024-53094)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: krealloc: Fix MTE false alarm in __do_krealloc\n\nThis patch addresses an issue introduced by commit 1a83a716ec233 (\u0026quot;mm:\nkrealloc: consider spare memory for __GFP_ZERO\u0026quot;) which causes MTE\n(Memory Tagging Extension) to falsely report a slab-out-of-bounds error.\n\nThe problem occurs when zeroing out spare memory in __do_krealloc. The\noriginal code only considered software-based KASAN and did not account\nfor MTE. It does not reset the KASAN tag before calling memset, leading\nto a mismatch between the pointer tag and the memory tag, resulting\nin a false positive.\n\nExample of the error:\n==================================================================\nswapper/0: BUG: KASAN: slab-out-of-bounds in __memset+0x84/0x188\nswapper/0: Write at addr f4ffff8005f0fdf0 by task swapper/0/1\nswapper/0: Pointer tag: [f4], memory tag: [fe]\nswapper/0:\nswapper/0: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.\nswapper/0: Hardware name: MT6991(ENG) (DT)\nswapper/0: Call trace:\nswapper/0:  dump_backtrace+0xfc/0x17c\nswapper/0:  show_stack+0x18/0x28\nswapper/0:  dump_stack_lvl+0x40/0xa0\nswapper/0:  print_report+0x1b8/0x71c\nswapper/0:  kasan_report+0xec/0x14c\nswapper/0:  __do_kernel_fault+0x60/0x29c\nswapper/0:  do_bad_area+0x30/0xdc\nswapper/0:  do_tag_check_fault+0x20/0x34\nswapper/0:  do_mem_abort+0x58/0x104\nswapper/0:  el1_abort+0x3c/0x5c\nswapper/0:  el1h_64_sync_handler+0x80/0xcc\nswapper/0:  el1h_64_sync+0x68/0x6c\nswapper/0:  __memset+0x84/0x188\nswapper/0:  btf_populate_kfunc_set+0x280/0x3d8\nswapper/0:  __register_btf_kfunc_id_set+0x43c/0x468\nswapper/0:  register_btf_kfunc_id_set+0x48/0x60\nswapper/0:  register_nf_nat_bpf+0x1c/0x40\nswapper/0:  nf_nat_init+0xc0/0x128\nswapper/0:  do_one_initcall+0x184/0x464\nswapper/0:  do_initcall_level+0xdc/0x1b0\nswapper/0:  do_initcalls+0x70/0xc0\nswapper/0:  do_basic_setup+0x1c/0x28\nswapper/0:  kernel_init_freeable+0x144/0x1b8\nswapper/0:  kernel_init+0x20/0x1a8\nswapper/0:  ret_from_fork+0x10/0x20\n==================================================================(CVE-2024-53097)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: tcp: avoid race between queue_lock lock and destroy\n\nCommit 76d54bf20cdc (\u0026quot;nvme-tcp: don\u0026apos;t access released socket during\nerror recovery\u0026quot;) added a mutex_lock() call for the queue-\u0026gt;queue_lock\nin nvme_tcp_get_address(). However, the mutex_lock() races with\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\n\nDEBUG_LOCKS_WARN_ON(lock-\u0026gt;magic != lock)\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:__mutex_lock+0xcf0/0x1220\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u0026lt;0f\u0026gt; 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\nFS:  00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __warn.cold+0x5b/0x1af\n ? __mutex_lock+0xcf0/0x1220\n ? report_bug+0x1ec/0x390\n ? handle_bug+0x3c/0x80\n ? exc_invalid_op+0x13/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? __mutex_lock+0xcf0/0x1220\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx___mutex_lock+0x10/0x10\n ? __lock_acquire+0xd6a/0x59e0\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\n dev_attr_show+0x42/0x80\n ? __asan_memset+0x1f/0x40\n sysfs_kf_seq_show+0x1f0/0x370\n seq_read_iter+0x2cb/0x1130\n ? rw_verify_area+0x3b1/0x590\n ? __mutex_lock+0x433/0x1220\n vfs_read+0x6a6/0xa20\n ? lockdep_hardirqs_on+0x78/0x100\n ? __pfx_vfs_read+0x10/0x10\n ksys_read+0xf7/0x1d0\n ? __pfx_ksys_read+0x10/0x10\n ? __x64_sys_openat+0x105/0x1d0\n do_syscall_64+0x93/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? __pfx_ksys_read+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? do_syscall_64+0x9f/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f9713f55cfa\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\n---truncated---(CVE-2024-53100)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nima: fix buffer overrun in ima_eventdigest_init_common\n\nFunction ima_eventdigest_init() calls ima_eventdigest_init_common()\nwith HASH_ALGO__LAST which is then used to access the array\nhash_digest_size[] leading to buffer overrun. Have a conditional\nstatement to handle this.(CVE-2024-53106)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnommu: pass NULL argument to vma_iter_prealloc()\n\nWhen deleting a vma entry from a maple tree, it has to pass NULL to\nvma_iter_prealloc() in order to calculate internal state of the tree, but\nit passed a wrong argument.  As a result, nommu kernels crashed upon\naccessing a vma iterator, such as acct_collect() reading the size of vma\nentries after do_munmap().\n\nThis commit fixes this issue by passing a right argument to the\npreallocation call.(CVE-2024-53109)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix NULL pointer dereference in alloc_pages_bulk_noprof\n\nWe triggered a NULL pointer dereference for ac.preferred_zoneref-\u0026gt;zone in\nalloc_pages_bulk_noprof() when the task is migrated between cpusets.\n\nWhen cpuset is enabled, in prepare_alloc_pages(), ac-\u0026gt;nodemask may be\n\u0026amp;current-\u0026gt;mems_allowed.  when first_zones_zonelist() is called to find\npreferred_zoneref, the ac-\u0026gt;nodemask may be modified concurrently if the\ntask is migrated between different cpusets.  Assuming we have 2 NUMA Node,\nwhen traversing Node1 in ac-\u0026gt;zonelist, the nodemask is 2, and when\ntraversing Node2 in ac-\u0026gt;zonelist, the nodemask is 1.  As a result, the\nac-\u0026gt;preferred_zoneref points to NULL zone.\n\nIn alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a\nallowable zone and calls zonelist_node_idx(ac.preferred_zoneref), leading\nto NULL pointer dereference.\n\n__alloc_pages_noprof() fixes this issue by checking NULL pointer in commit\nea57485af8f4 (\u0026quot;mm, page_alloc: fix check for NULL preferred_zone\u0026quot;) and\ncommit df76cee6bbeb (\u0026quot;mm, page_alloc: remove redundant checks from alloc\nfastpath\u0026quot;).\n\nTo fix it, check NULL pointer for preferred_zoneref-\u0026gt;zone.(CVE-2024-53113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio/vsock: Fix accept_queue memory leak\n\nAs the final stages of socket destruction may be delayed, it is possible\nthat virtio_transport_recv_listen() will be called after the accept_queue\nhas been flushed, but before the SOCK_DONE flag has been set. As a result,\nsockets enqueued after the flush would remain unremoved, leading to a\nmemory leak.\n\nvsock_release\n  __vsock_release\n    lock\n    virtio_transport_release\n      virtio_transport_close\n        schedule_delayed_work(close_work)\n    sk_shutdown = SHUTDOWN_MASK\n(!) flush accept_queue\n    release\n                                        virtio_transport_recv_pkt\n                                          vsock_find_bound_socket\n                                          lock\n                                          if flag(SOCK_DONE) return\n                                          virtio_transport_recv_listen\n                                            child = vsock_create_connected\n                                      (!)   vsock_enqueue_accept(child)\n                                          release\nclose_work\n  lock\n  virtio_transport_do_close\n    set_flag(SOCK_DONE)\n    virtio_transport_remove_sock\n      vsock_remove_sock\n        vsock_remove_bound\n  release\n\nIntroduce a sk_shutdown check to disallow vsock_enqueue_accept() during\nsocket destruction.\n\nunreferenced object 0xffff888109e3f800 (size 2040):\n  comm \u0026quot;kworker/5:2\u0026quot;, pid 371, jiffies 4294940105\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    28 00 0b 40 00 00 00 00 00 00 00 00 00 00 00 00  (..@............\n  backtrace (crc 9e5f4e84):\n    [\u0026lt;ffffffff81418ff1\u0026gt;] kmem_cache_alloc_noprof+0x2c1/0x360\n    [\u0026lt;ffffffff81d27aa0\u0026gt;] sk_prot_alloc+0x30/0x120\n    [\u0026lt;ffffffff81d2b54c\u0026gt;] sk_alloc+0x2c/0x4b0\n    [\u0026lt;ffffffff81fe049a\u0026gt;] __vsock_create.constprop.0+0x2a/0x310\n    [\u0026lt;ffffffff81fe6d6c\u0026gt;] virtio_transport_recv_pkt+0x4dc/0x9a0\n    [\u0026lt;ffffffff81fe745d\u0026gt;] vsock_loopback_work+0xfd/0x140\n    [\u0026lt;ffffffff810fc6ac\u0026gt;] process_one_work+0x20c/0x570\n    [\u0026lt;ffffffff810fce3f\u0026gt;] worker_thread+0x1bf/0x3a0\n    [\u0026lt;ffffffff811070dd\u0026gt;] kthread+0xdd/0x110\n    [\u0026lt;ffffffff81044fdd\u0026gt;] ret_from_fork+0x2d/0x50\n    [\u0026lt;ffffffff8100785a\u0026gt;] ret_from_fork_asm+0x1a/0x30(CVE-2024-53119)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: CT: Fix null-ptr-deref in add rule err flow\n\nIn error flow of mlx5_tc_ct_entry_add_rule(), in case ct_rule_add()\ncallback returns error, zone_rule-\u0026gt;attr is used uninitiated. Fix it to\nuse attr which has the needed pointer value.\n\nKernel log:\n BUG: kernel NULL pointer dereference, address: 0000000000000110\n RIP: 0010:mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core]\n…\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die+0x20/0x70\n  ? page_fault_oops+0x150/0x3e0\n  ? exc_page_fault+0x74/0x140\n  ? asm_exc_page_fault+0x22/0x30\n  ? mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core]\n  ? mlx5_tc_ct_entry_add_rule+0x1d5/0x2f0 [mlx5_core]\n  mlx5_tc_ct_block_flow_offload+0xc6a/0xf90 [mlx5_core]\n  ? nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table]\n  nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table]\n  flow_offload_work_handler+0x142/0x320 [nf_flow_table]\n  ? finish_task_switch.isra.0+0x15b/0x2b0\n  process_one_work+0x16c/0x320\n  worker_thread+0x28c/0x3a0\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0xb8/0xf0\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x2d/0x50\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;(CVE-2024-53120)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, lock FTE when checking if active\n\nThe referenced commits introduced a two-step process for deleting FTEs:\n\n- Lock the FTE, delete it from hardware, set the hardware deletion function\n  to NULL and unlock the FTE.\n- Lock the parent flow group, delete the software copy of the FTE, and\n  remove it from the xarray.\n\nHowever, this approach encounters a race condition if a rule with the same\nmatch value is added simultaneously. In this scenario, fs_core may set the\nhardware deletion function to NULL prematurely, causing a panic during\nsubsequent rule deletions.\n\nTo prevent this, ensure the active flag of the FTE is checked under a lock,\nwhich will prevent the fs_core layer from attaching a new steering rule to\nan FTE that is in the process of deletion.\n\n[  438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func\n[  438.968205] ------------[ cut here ]------------\n[  438.968654] refcount_t: decrement hit 0; leaking memory.\n[  438.969249] WARNING: CPU: 0 PID: 8957 at lib/refcount.c:31 refcount_warn_saturate+0xfb/0x110\n[  438.970054] Modules linked in: act_mirred cls_flower act_gact sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core zram zsmalloc fuse [last unloaded: cls_flower]\n[  438.973288] CPU: 0 UID: 0 PID: 8957 Comm: tc Not tainted 6.12.0-rc1+ #8\n[  438.973888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  438.974874] RIP: 0010:refcount_warn_saturate+0xfb/0x110\n[  438.975363] Code: 40 66 3b 82 c6 05 16 e9 4d 01 01 e8 1f 7c a0 ff 0f 0b c3 cc cc cc cc 48 c7 c7 10 66 3b 82 c6 05 fd e8 4d 01 01 e8 05 7c a0 ff \u0026lt;0f\u0026gt; 0b c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90\n[  438.976947] RSP: 0018:ffff888124a53610 EFLAGS: 00010286\n[  438.977446] RAX: 0000000000000000 RBX: ffff888119d56de0 RCX: 0000000000000000\n[  438.978090] RDX: ffff88852c828700 RSI: ffff88852c81b3c0 RDI: ffff88852c81b3c0\n[  438.978721] RBP: ffff888120fa0e88 R08: 0000000000000000 R09: ffff888124a534b0\n[  438.979353] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888119d56de0\n[  438.979979] R13: ffff888120fa0ec0 R14: ffff888120fa0ee8 R15: ffff888119d56de0\n[  438.980607] FS:  00007fe6dcc0f800(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000\n[  438.983984] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  438.984544] CR2: 00000000004275e0 CR3: 0000000186982001 CR4: 0000000000372eb0\n[  438.985205] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  438.985842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  438.986507] Call Trace:\n[  438.986799]  \u0026lt;TASK\u0026gt;\n[  438.987070]  ? __warn+0x7d/0x110\n[  438.987426]  ? refcount_warn_saturate+0xfb/0x110\n[  438.987877]  ? report_bug+0x17d/0x190\n[  438.988261]  ? prb_read_valid+0x17/0x20\n[  438.988659]  ? handle_bug+0x53/0x90\n[  438.989054]  ? exc_invalid_op+0x14/0x70\n[  438.989458]  ? asm_exc_invalid_op+0x16/0x20\n[  438.989883]  ? refcount_warn_saturate+0xfb/0x110\n[  438.990348]  mlx5_del_flow_rules+0x2f7/0x340 [mlx5_core]\n[  438.990932]  __mlx5_eswitch_del_rule+0x49/0x170 [mlx5_core]\n[  438.991519]  ? mlx5_lag_is_sriov+0x3c/0x50 [mlx5_core]\n[  438.992054]  ? xas_load+0x9/0xb0\n[  438.992407]  mlx5e_tc_rule_unoffload+0x45/0xe0 [mlx5_core]\n[  438.993037]  mlx5e_tc_del_fdb_flow+0x2a6/0x2e0 [mlx5_core]\n[  438.993623]  mlx5e_flow_put+0x29/0x60 [mlx5_core]\n[  438.994161]  mlx5e_delete_flower+0x261/0x390 [mlx5_core]\n[  438.994728]  tc_setup_cb_destroy+0xb9/0x190\n[  438.995150]  fl_hw_destroy_filter+0x94/0xc0 [cls_flower]\n[  438.995650]  fl_change+0x11a4/0x13c0 [cls_flower]\n[  438.996105]  tc_new_tfilter+0x347/0xbc0\n[  438.996503]  ? __\n---truncated---(CVE-2024-53121)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: cope racing subflow creation in mptcp_rcv_space_adjust\n\nAdditional active subflows - i.e. created by the in kernel path\nmanager - are included into the subflow list before starting the\n3whs.\n\nA racing recvmsg() spooling data received on an already established\nsubflow would unconditionally call tcp_cleanup_rbuf() on all the\ncurrent subflows, potentially hitting a divide by zero error on\nthe newly created ones.\n\nExplicitly check that the subflow is in a suitable state before\ninvoking tcp_cleanup_rbuf().(CVE-2024-53122)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: error out earlier on disconnect\n\nEric reported a division by zero splat in the MPTCP protocol:\n\nOops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 UID: 0 PID: 6094 Comm: syz-executor317 Not tainted\n6.12.0-rc5-syzkaller-00291-g05b92660cdfe #0\nHardware name: Google Google Compute Engine/Google Compute Engine,\nBIOS Google 09/13/2024\nRIP: 0010:__tcp_select_window+0x5b4/0x1310 net/ipv4/tcp_output.c:3163\nCode: f6 44 01 e3 89 df e8 9b 75 09 f8 44 39 f3 0f 8d 11 ff ff ff e8\n0d 74 09 f8 45 89 f4 e9 04 ff ff ff e8 00 74 09 f8 44 89 f0 99 \u0026lt;f7\u0026gt; 7c\n24 14 41 29 d6 45 89 f4 e9 ec fe ff ff e8 e8 73 09 f8 48 89\nRSP: 0018:ffffc900041f7930 EFLAGS: 00010293\nRAX: 0000000000017e67 RBX: 0000000000017e67 RCX: ffffffff8983314b\nRDX: 0000000000000000 RSI: ffffffff898331b0 RDI: 0000000000000004\nRBP: 00000000005d6000 R08: 0000000000000004 R09: 0000000000017e67\nR10: 0000000000003e80 R11: 0000000000000000 R12: 0000000000003e80\nR13: ffff888031d9b440 R14: 0000000000017e67 R15: 00000000002eb000\nFS: 00007feb5d7f16c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007feb5d8adbb8 CR3: 0000000074e4c000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u0026lt;TASK\u0026gt;\n__tcp_cleanup_rbuf+0x3e7/0x4b0 net/ipv4/tcp.c:1493\nmptcp_rcv_space_adjust net/mptcp/protocol.c:2085 [inline]\nmptcp_recvmsg+0x2156/0x2600 net/mptcp/protocol.c:2289\ninet_recvmsg+0x469/0x6a0 net/ipv4/af_inet.c:885\nsock_recvmsg_nosec net/socket.c:1051 [inline]\nsock_recvmsg+0x1b2/0x250 net/socket.c:1073\n__sys_recvfrom+0x1a5/0x2e0 net/socket.c:2265\n__do_sys_recvfrom net/socket.c:2283 [inline]\n__se_sys_recvfrom net/socket.c:2279 [inline]\n__x64_sys_recvfrom+0xe0/0x1c0 net/socket.c:2279\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7feb5d857559\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48\n89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d\n01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007feb5d7f1208 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\nRAX: ffffffffffffffda RBX: 00007feb5d8e1318 RCX: 00007feb5d857559\nRDX: 000000800000000e RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007feb5d8e1310 R08: 0000000000000000 R09: ffffffff81000000\nR10: 0000000000000100 R11: 0000000000000246 R12: 00007feb5d8e131c\nR13: 00007feb5d8ae074 R14: 000000800000000e R15: 00000000fffffdef\n\nand provided a nice reproducer.\n\nThe root cause is the current bad handling of racing disconnect.\nAfter the blamed commit below, sk_wait_data() can return (with\nerror) with the underlying socket disconnected and a zero rcv_mss.\n\nCatch the error and return without performing any additional\noperations on the current socket.(CVE-2024-53123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix data-races around sk-\u0026gt;sk_forward_alloc\n\nSyzkaller reported this warning:\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0\n Modules linked in:\n CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:inet_sock_destruct+0x1c5/0x1e0\n Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 \u0026lt;0f\u0026gt; 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00\n RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206\n RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007\n RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00\n RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007\n R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00\n R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78\n FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __warn+0x88/0x130\n  ? inet_sock_destruct+0x1c5/0x1e0\n  ? report_bug+0x18e/0x1a0\n  ? handle_bug+0x53/0x90\n  ? exc_invalid_op+0x18/0x70\n  ? asm_exc_invalid_op+0x1a/0x20\n  ? inet_sock_destruct+0x1c5/0x1e0\n  __sk_destruct+0x2a/0x200\n  rcu_do_batch+0x1aa/0x530\n  ? rcu_do_batch+0x13b/0x530\n  rcu_core+0x159/0x2f0\n  handle_softirqs+0xd3/0x2b0\n  ? __pfx_smpboot_thread_fn+0x10/0x10\n  run_ksoftirqd+0x25/0x30\n  smpboot_thread_fn+0xdd/0x1d0\n  kthread+0xd3/0x100\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x34/0x50\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;\n ---[ end trace 0000000000000000 ]---\n\nIts possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add()\nconcurrently when sk-\u0026gt;sk_state == TCP_LISTEN with sk-\u0026gt;sk_lock unlocked,\nwhich triggers a data-race around sk-\u0026gt;sk_forward_alloc:\ntcp_v6_rcv\n    tcp_v6_do_rcv\n        skb_clone_and_charge_r\n            sk_rmem_schedule\n                __sk_mem_schedule\n                    sk_forward_alloc_add()\n            skb_set_owner_r\n                sk_mem_charge\n                    sk_forward_alloc_add()\n        __kfree_skb\n            skb_release_all\n                skb_release_head_state\n                    sock_rfree\n                        sk_mem_uncharge\n                            sk_forward_alloc_add()\n                            sk_mem_reclaim\n                                // set local var reclaimable\n                                __sk_mem_reclaim\n                                    sk_forward_alloc_add()\n\nIn this syzkaller testcase, two threads call\ntcp_v6_do_rcv() with skb-\u0026gt;truesize=768, the sk_forward_alloc changes like\nthis:\n (cpu 1)             | (cpu 2)             | sk_forward_alloc\n ...                 | ...                 | 0\n __sk_mem_schedule() |                     | +4096 = 4096\n                     | __sk_mem_schedule() | +4096 = 8192\n sk_mem_charge()     |                     | -768  = 7424\n                     | sk_mem_charge()     | -768  = 6656\n ...                 |    ...              |\n sk_mem_uncharge()   |                     | +768  = 7424\n reclaimable=7424    |                     |\n                     | sk_mem_uncharge()   | +768  = 8192\n                     | reclaimable=8192    |\n __sk_mem_reclaim()  |                     | -4096 = 4096\n                     | __sk_mem_reclaim()  | -8192 = -4096 != 0\n\nThe skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when\nsk-\u0026gt;sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock().\nFix the same issue in dccp_v6_do_rcv().(CVE-2024-53124)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN\n\nHide KVM\u0026apos;s pt_mode module param behind CONFIG_BROKEN, i.e. disable support\nfor virtualizing Intel PT via guest/host mode unless BROKEN=y.  There are\nmyriad bugs in the implementation, some of which are fatal to the guest,\nand others which put the stability and health of the host at risk.\n\nFor guest fatalities, the most glaring issue is that KVM fails to ensure\ntracing is disabled, and *stays* disabled prior to VM-Enter, which is\nnecessary as hardware disallows loading (the guest\u0026apos;s) RTIT_CTL if tracing\nis enabled (enforced via a VMX consistency check).  Per the SDM:\n\n  If the logical processor is operating with Intel PT enabled (if\n  IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the \u0026quot;load\n  IA32_RTIT_CTL\u0026quot; VM-entry control must be 0.\n\nOn the host side, KVM doesn\u0026apos;t validate the guest CPUID configuration\nprovided by userspace, and even worse, uses the guest configuration to\ndecide what MSRs to save/load at VM-Enter and VM-Exit.  E.g. configuring\nguest CPUID to enumerate more address ranges than are supported in hardware\nwill result in KVM trying to passthrough, save, and load non-existent MSRs,\nwhich generates a variety of WARNs, ToPA ERRORs in the host, a potential\ndeadlock, etc.(CVE-2024-53135)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\u0026quot;nfs: add support for large folios\u0026quot;)).(CVE-2024-53138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix possible UAF in sctp_v6_available()\n\nA lockdep report [1] with CONFIG_PROVE_RCU_LIST=y hints\nthat sctp_v6_available() is calling dev_get_by_index_rcu()\nand ipv6_chk_addr() without holding rcu.\n\n[1]\n =============================\n WARNING: suspicious RCU usage\n 6.12.0-rc5-virtme #1216 Tainted: G        W\n -----------------------------\n net/core/dev.c:876 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n 1 lock held by sctp_hello/31495:\n #0: ffff9f1ebbdb7418 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_bind (./arch/x86/include/asm/jump_label.h:27 net/sctp/socket.c:315) sctp\n\nstack backtrace:\n CPU: 7 UID: 0 PID: 31495 Comm: sctp_hello Tainted: G        W          6.12.0-rc5-virtme #1216\n Tainted: [W]=WARN\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n dump_stack_lvl (lib/dump_stack.c:123)\n lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)\n dev_get_by_index_rcu (net/core/dev.c:876 (discriminator 7))\n sctp_v6_available (net/sctp/ipv6.c:701) sctp\n sctp_do_bind (net/sctp/socket.c:400 (discriminator 1)) sctp\n sctp_bind (net/sctp/socket.c:320) sctp\n inet6_bind_sk (net/ipv6/af_inet6.c:465)\n ? security_socket_bind (security/security.c:4581 (discriminator 1))\n __sys_bind (net/socket.c:1848 net/socket.c:1869)\n ? do_user_addr_fault (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/linux/mm.h:729 arch/x86/mm/fault.c:1340)\n ? do_user_addr_fault (./arch/x86/include/asm/preempt.h:84 (discriminator 13) ./include/linux/rcupdate.h:98 (discriminator 13) ./include/linux/rcupdate.h:882 (discriminator 13) ./include/linux/mm.h:729 (discriminator 13) arch/x86/mm/fault.c:1340 (discriminator 13))\n __x64_sys_bind (net/socket.c:1877 (discriminator 1) net/socket.c:1875 (discriminator 1) net/socket.c:1875 (discriminator 1))\n do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n RIP: 0033:0x7f59b934a1e7\n Code: 44 00 00 48 8b 15 39 8c 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 31 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 09 8c 0c 00 f7 d8 64 89 01 48\nAll code\n========\n   0:\t44 00 00             \tadd    %r8b,(%rax)\n   3:\t48 8b 15 39 8c 0c 00 \tmov    0xc8c39(%rip),%rdx        # 0xc8c43\n   a:\tf7 d8                \tneg    %eax\n   c:\t64 89 02             \tmov    %eax,%fs:(%rdx)\n   f:\tb8 ff ff ff ff       \tmov    $0xffffffff,%eax\n  14:\teb bd                \tjmp    0xffffffffffffffd3\n  16:\t66 2e 0f 1f 84 00 00 \tcs nopw 0x0(%rax,%rax,1)\n  1d:\t00 00 00\n  20:\t0f 1f 00             \tnopl   (%rax)\n  23:\tb8 31 00 00 00       \tmov    $0x31,%eax\n  28:\t0f 05                \tsyscall\n  2a:*\t48 3d 01 f0 ff ff    \tcmp    $0xfffffffffffff001,%rax\t\t\u0026lt;-- trapping instruction\n  30:\t73 01                \tjae    0x33\n  32:\tc3                   \tret\n  33:\t48 8b 0d 09 8c 0c 00 \tmov    0xc8c09(%rip),%rcx        # 0xc8c43\n  3a:\tf7 d8                \tneg    %eax\n  3c:\t64 89 01             \tmov    %eax,%fs:(%rcx)\n  3f:\t48                   \trex.W\n\nCode starting with the faulting instruction\n===========================================\n   0:\t48 3d 01 f0 ff ff    \tcmp    $0xfffffffffffff001,%rax\n   6:\t73 01                \tjae    0x9\n   8:\tc3                   \tret\n   9:\t48 8b 0d 09 8c 0c 00 \tmov    0xc8c09(%rip),%rcx        # 0xc8c19\n  10:\tf7 d8                \tneg    %eax\n  12:\t64 89 01             \tmov    %eax,%fs:(%rcx)\n  15:\t48                   \trex.W\n RSP: 002b:00007ffe2d0ad398 EFLAGS: 00000202 ORIG_RAX: 0000000000000031\n RAX: ffffffffffffffda RBX: 00007ffe2d0ad3d0 RCX: 00007f59b934a1e7\n RDX: 000000000000001c RSI: 00007ffe2d0ad3d0 RDI: 0000000000000005\n RBP: 0000000000000005 R08: 1999999999999999 R09: 0000000000000000\n R10: 00007f59b9253298 R11: 000000000000\n---truncated---(CVE-2024-53139)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: terminate outstanding dump on socket close\n\nNetlink supports iterative dumping of data. It provides the families\nthe following ops:\n - start - (optional) kicks off the dumping process\n - dump  - actual dump helper, keeps getting called until it returns 0\n - done  - (optional) pairs with .start, can be used for cleanup\nThe whole process is asynchronous and the repeated calls to .dump\ndon\u0026apos;t actually happen in a tight loop, but rather are triggered\nin response to recvmsg() on the socket.\n\nThis gives the user full control over the dump, but also means that\nthe user can close the socket without getting to the end of the dump.\nTo make sure .start is always paired with .done we check if there\nis an ongoing dump before freeing the socket, and if so call .done.\n\nThe complication is that sockets can get freed from BH and .done\nis allowed to sleep. So we use a workqueue to defer the call, when\nneeded.\n\nUnfortunately this does not work correctly. What we defer is not\nthe cleanup but rather releasing a reference on the socket.\nWe have no guarantee that we own the last reference, if someone\nelse holds the socket they may release it in BH and we\u0026apos;re back\nto square one.\n\nThe whole dance, however, appears to be unnecessary. Only the user\ncan interact with dumps, so we can clean up when socket is closed.\nAnd close always happens in process context. Some async code may\nstill access the socket after close, queue notification skbs to it etc.\nbut no dumps can start, end or otherwise make progress.\n\nDelete the workqueue and flush the dump state directly from the release\nhandler. Note that further cleanup is possible in -next, for instance\nwe now always call .done before releasing the main module reference,\nso dump doesn\u0026apos;t have to take a reference of its own.(CVE-2024-53140)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE\n\nThis aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4\n(\u0026quot;Bluetooth: Always request for user confirmation for Just Works\u0026quot;)\nalways request user confirmation with confirm_hint set since the\nlikes of bluetoothd have dedicated policy around JUST_WORKS method\n(e.g. main.conf:JustWorksRepairing).\n\nCVE: CVE-2024-8805(CVE-2024-53144)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential integer overflow during physmem setup\n\nThis issue happens when the real map size is greater than LONG_MAX,\nwhich can be easily triggered on UML/i386.(CVE-2024-53145)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix bfqq uaf in bfq_limit_depth()\n\nSet new allocated bfqq to bic or remove freed bfqq from bic are both\nprotected by bfqd-\u0026gt;lock, however bfq_limit_depth() is deferencing bfqq\nfrom bic without the lock, this can lead to UAF if the io_context is\nshared by multiple tasks.\n\nFor example, test bfq with io_uring can trigger following UAF in v6.6:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50\n\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x47/0x80\n print_address_description.constprop.0+0x66/0x300\n print_report+0x3e/0x70\n kasan_report+0xb4/0xf0\n bfqq_group+0x15/0x50\n bfqq_request_over_limit+0x130/0x9a0\n bfq_limit_depth+0x1b5/0x480\n __blk_mq_alloc_requests+0x2b5/0xa00\n blk_mq_get_new_requests+0x11d/0x1d0\n blk_mq_submit_bio+0x286/0xb00\n submit_bio_noacct_nocheck+0x331/0x400\n __block_write_full_folio+0x3d0/0x640\n writepage_cb+0x3b/0xc0\n write_cache_pages+0x254/0x6c0\n write_cache_pages+0x254/0x6c0\n do_writepages+0x192/0x310\n filemap_fdatawrite_wbc+0x95/0xc0\n __filemap_fdatawrite_range+0x99/0xd0\n filemap_write_and_wait_range.part.0+0x4d/0xa0\n blkdev_read_iter+0xef/0x1e0\n io_read+0x1b6/0x8a0\n io_issue_sqe+0x87/0x300\n io_wq_submit_work+0xeb/0x390\n io_worker_handle_work+0x24d/0x550\n io_wq_worker+0x27f/0x6c0\n ret_from_fork_asm+0x1b/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 808602:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n __kasan_slab_alloc+0x83/0x90\n kmem_cache_alloc_node+0x1b1/0x6d0\n bfq_get_queue+0x138/0xfa0\n bfq_get_bfqq_handle_split+0xe3/0x2c0\n bfq_init_rq+0x196/0xbb0\n bfq_insert_request.isra.0+0xb5/0x480\n bfq_insert_requests+0x156/0x180\n blk_mq_insert_request+0x15d/0x440\n blk_mq_submit_bio+0x8a4/0xb00\n submit_bio_noacct_nocheck+0x331/0x400\n __blkdev_direct_IO_async+0x2dd/0x330\n blkdev_write_iter+0x39a/0x450\n io_write+0x22a/0x840\n io_issue_sqe+0x87/0x300\n io_wq_submit_work+0xeb/0x390\n io_worker_handle_work+0x24d/0x550\n io_wq_worker+0x27f/0x6c0\n ret_from_fork+0x2d/0x50\n ret_from_fork_asm+0x1b/0x30\n\nFreed by task 808589:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x27/0x40\n __kasan_slab_free+0x126/0x1b0\n kmem_cache_free+0x10c/0x750\n bfq_put_queue+0x2dd/0x770\n __bfq_insert_request.isra.0+0x155/0x7a0\n bfq_insert_request.isra.0+0x122/0x480\n bfq_insert_requests+0x156/0x180\n blk_mq_dispatch_plug_list+0x528/0x7e0\n blk_mq_flush_plug_list.part.0+0xe5/0x590\n __blk_flush_plug+0x3b/0x90\n blk_finish_plug+0x40/0x60\n do_writepages+0x19d/0x310\n filemap_fdatawrite_wbc+0x95/0xc0\n __filemap_fdatawrite_range+0x99/0xd0\n filemap_write_and_wait_range.part.0+0x4d/0xa0\n blkdev_read_iter+0xef/0x1e0\n io_read+0x1b6/0x8a0\n io_issue_sqe+0x87/0x300\n io_wq_submit_work+0xeb/0x390\n io_worker_handle_work+0x24d/0x550\n io_wq_worker+0x27f/0x6c0\n ret_from_fork+0x2d/0x50\n ret_from_fork_asm+0x1b/0x30\n\nFix the problem by protecting bic_to_bfqq() with bfqd-\u0026gt;lock.(CVE-2024-53166)\n\nIn the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipeThis commit addresses a null pointer dereference issue indcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ( drm/amd/display:Add null check for pipe_ctx-\u0026gt;plane_state in dcn20_program_pipe )partially fixed the null pointer dereference issue. However, indcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, andplane_state is accessed again through pipe_ctx. Multiple if statementsdirectly call attributes of plane_state, leading to potential nullpointer dereference issues. This patch adds necessary null checks toensure stability.(CVE-2024-53201)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix use-after-free of nreq in reqsk_timer_handler().\n\nThe cited commit replaced inet_csk_reqsk_queue_drop_and_put() with\n__inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler().\n\nThen, oreq should be passed to reqsk_put() instead of req; otherwise\nuse-after-free of nreq could happen when reqsk is migrated but the\nretry attempt failed (e.g. due to timeout).\n\nLet\u0026apos;s pass oreq to reqsk_put().(CVE-2024-53206)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix possible deadlocks\n\nThis fixes possible deadlocks like the following caused by\nhci_cmd_sync_dequeue causing the destroy function to run:\n\n INFO: task kworker/u19:0:143 blocked for more than 120 seconds.\n       Tainted: G        W  O        6.8.0-2024-03-19-intel-next-iLS-24ww14 #1\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:kworker/u19:0   state:D stack:0     pid:143   tgid:143   ppid:2      flags:0x00004000\n Workqueue: hci0 hci_cmd_sync_work [bluetooth]\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  __schedule+0x374/0xaf0\n  schedule+0x3c/0xf0\n  schedule_preempt_disabled+0x1c/0x30\n  __mutex_lock.constprop.0+0x3ef/0x7a0\n  __mutex_lock_slowpath+0x13/0x20\n  mutex_lock+0x3c/0x50\n  mgmt_set_connectable_complete+0xa4/0x150 [bluetooth]\n  ? kfree+0x211/0x2a0\n  hci_cmd_sync_dequeue+0xae/0x130 [bluetooth]\n  ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth]\n  cmd_complete_rsp+0x26/0x80 [bluetooth]\n  mgmt_pending_foreach+0x4d/0x70 [bluetooth]\n  __mgmt_power_off+0x8d/0x180 [bluetooth]\n  ? _raw_spin_unlock_irq+0x23/0x40\n  hci_dev_close_sync+0x445/0x5b0 [bluetooth]\n  hci_set_powered_sync+0x149/0x250 [bluetooth]\n  set_powered_sync+0x24/0x60 [bluetooth]\n  hci_cmd_sync_work+0x90/0x150 [bluetooth]\n  process_one_work+0x13e/0x300\n  worker_thread+0x2f7/0x420\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0x107/0x140\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x3d/0x60\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1b/0x30\n  \u0026lt;/TASK\u0026gt;(CVE-2024-53207)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix receive ring space parameters when XDP is active\n\nThe MTU setting at the time an XDP multi-buffer is attached\ndetermines whether the aggregation ring will be used and the\nrx_skb_func handler.  This is done in bnxt_set_rx_skb_mode().\n\nIf the MTU is later changed, the aggregation ring setting may need\nto be changed and it may become out-of-sync with the settings\ninitially done in bnxt_set_rx_skb_mode().  This may result in\nrandom memory corruption and crashes as the HW may DMA data larger\nthan the allocated buffer size, such as:\n\nBUG: kernel NULL pointer dereference, address: 00000000000003c0\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S         OE      6.1.0-226bf9805506 #1\nHardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021\nRIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en]\nCode: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 \u0026lt;0f\u0026gt; b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f\nRSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202\nRAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff\nRDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380\nRBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf\nR10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980\nR13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990\nFS:  0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en]\n\nTo address the issue, we now call bnxt_set_rx_skb_mode() within\nbnxt_change_mtu() to properly set the AGG rings configuration and\nupdate rx_skb_func based on the new MTU value.\nAdditionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of\nbnxt_set_rx_skb_mode() to make sure it gets set or cleared based on\nthe current MTU.(CVE-2024-53209)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs\n\nBase clocks are the first in being probed and are real dependencies of the\nrest of fixed, factor and peripheral clocks. For old ralink SoCs RT2880,\nRT305x and RT3883 \u0026apos;xtal\u0026apos; must be defined first since in any other case,\nwhen fixed clocks are probed they are delayed until \u0026apos;xtal\u0026apos; is probed so the\nfollowing warning appears:\n\n WARNING: CPU: 0 PID: 0 at drivers/clk/ralink/clk-mtmips.c:499 rt3883_bus_recalc_rate+0x98/0x138\n Modules linked in:\n CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.43 #0\n Stack : 805e58d0 00000000 00000004 8004f950 00000000 00000004 00000000 00000000\n 80669c54 80830000 80700000 805ae570 80670068 00000001 80669bf8 00000000\n 00000000 00000000 805ae570 80669b38 00000020 804db7dc 00000000 00000000\n 203a6d6d 80669b78 80669e48 70617773 00000000 805ae570 00000000 00000009\n 00000000 00000001 00000004 00000001 00000000 00000000 83fe43b0 00000000\n ...\n Call Trace:\n [\u0026lt;800065d0\u0026gt;] show_stack+0x64/0xf4\n [\u0026lt;804bca14\u0026gt;] dump_stack_lvl+0x38/0x60\n [\u0026lt;800218ac\u0026gt;] __warn+0x94/0xe4\n [\u0026lt;8002195c\u0026gt;] warn_slowpath_fmt+0x60/0x94\n [\u0026lt;80259ff8\u0026gt;] rt3883_bus_recalc_rate+0x98/0x138\n [\u0026lt;80254530\u0026gt;] __clk_register+0x568/0x688\n [\u0026lt;80254838\u0026gt;] of_clk_hw_register+0x18/0x2c\n [\u0026lt;8070b910\u0026gt;] rt2880_clk_of_clk_init_driver+0x18c/0x594\n [\u0026lt;8070b628\u0026gt;] of_clk_init+0x1c0/0x23c\n [\u0026lt;806fc448\u0026gt;] plat_time_init+0x58/0x18c\n [\u0026lt;806fdaf0\u0026gt;] time_init+0x10/0x6c\n [\u0026lt;806f9bc4\u0026gt;] start_kernel+0x458/0x67c\n\n ---[ end trace 0000000000000000 ]---\n\nWhen this driver was mainlined we could not find any active users of old\nralink SoCs so we cannot perform any real tests for them. Now, one user\nof a Belkin f9k1109 version 1 device which uses RT3883 SoC appeared and\nreported some issues in openWRT:\n- https://github.com/openwrt/openwrt/issues/16054\n\nThus, define a \u0026apos;rt2880_xtal_recalc_rate()\u0026apos; just returning the expected\nfrequency 40Mhz and use it along the old ralink SoCs to have a correct\nboot trace with no warnings and a working clock plan from the beggining.(CVE-2024-53223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix use-after-free in device_for_each_child()\n\nSyzbot has reported the following KASAN splat:\n\nBUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0\nRead of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980\n\nCPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x100/0x190\n ? device_for_each_child+0x18f/0x1a0\n print_report+0x13a/0x4cb\n ? __virt_addr_valid+0x5e/0x590\n ? __phys_addr+0xc6/0x150\n ? device_for_each_child+0x18f/0x1a0\n kasan_report+0xda/0x110\n ? device_for_each_child+0x18f/0x1a0\n ? __pfx_dev_memalloc_noio+0x10/0x10\n device_for_each_child+0x18f/0x1a0\n ? __pfx_device_for_each_child+0x10/0x10\n pm_runtime_set_memalloc_noio+0xf2/0x180\n netdev_unregister_kobject+0x1ed/0x270\n unregister_netdevice_many_notify+0x123c/0x1d80\n ? __mutex_trylock_common+0xde/0x250\n ? __pfx_unregister_netdevice_many_notify+0x10/0x10\n ? trace_contention_end+0xe6/0x140\n ? __mutex_lock+0x4e7/0x8f0\n ? __pfx_lock_acquire.part.0+0x10/0x10\n ? rcu_is_watching+0x12/0xc0\n ? unregister_netdev+0x12/0x30\n unregister_netdevice_queue+0x30d/0x3f0\n ? __pfx_unregister_netdevice_queue+0x10/0x10\n ? __pfx_down_write+0x10/0x10\n unregister_netdev+0x1c/0x30\n bnep_session+0x1fb3/0x2ab0\n ? __pfx_bnep_session+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? __pfx_woken_wake_function+0x10/0x10\n ? __kthread_parkme+0x132/0x200\n ? __pfx_bnep_session+0x10/0x10\n ? kthread+0x13a/0x370\n ? __pfx_bnep_session+0x10/0x10\n kthread+0x2b7/0x370\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x48/0x80\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 4974:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kmalloc_noprof+0x1d1/0x440\n hci_alloc_dev_priv+0x1d/0x2820\n __vhci_create_device+0xef/0x7d0\n vhci_write+0x2c7/0x480\n vfs_write+0x6a0/0xfc0\n ksys_write+0x12f/0x260\n do_syscall_64+0xc7/0x250\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 4979:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x4f/0x70\n kfree+0x141/0x490\n hci_release_dev+0x4d9/0x600\n bt_host_release+0x6a/0xb0\n device_release+0xa4/0x240\n kobject_put+0x1ec/0x5a0\n put_device+0x1f/0x30\n vhci_release+0x81/0xf0\n __fput+0x3f6/0xb30\n task_work_run+0x151/0x250\n do_exit+0xa79/0x2c30\n do_group_exit+0xd5/0x2a0\n get_signal+0x1fcd/0x2210\n arch_do_signal_or_restart+0x93/0x780\n syscall_exit_to_user_mode+0x140/0x290\n do_syscall_64+0xd4/0x250\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nIn \u0026apos;hci_conn_del_sysfs()\u0026apos;, \u0026apos;device_unregister()\u0026apos; may be called when\nan underlying (kobject) reference counter is greater than 1. This\nmeans that reparenting (happened when the device is actually freed)\nis delayed and, during that delay, parent controller device (hciX)\nmay be deleted. Since the latter may create a dangling pointer to\nfreed parent, avoid that scenario by reparenting to NULL explicitly.(CVE-2024-53237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()\n\nMove pm_runtime_set_active() to ivpu_pm_init() so when\nivpu_ipc_send_receive_internal() is executed before ivpu_pm_enable()\nit already has correct runtime state, even if last resume was\nnot successful..(CVE-2024-54193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer\n\nThe AD7923 was updated to support devices with 8 channels, but the size\nof tx_buf and ring_xfer was not increased accordingly, leading to a\npotential buffer overflow in ad7923_update_scan_mode().(CVE-2024-56557)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nad7780: fix division by zero in ad7780_write_raw()\n\nIn the ad7780_write_raw() , val2 can be zero, which might lead to a\ndivision by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw()\nis based on iio_info\u0026apos;s write_raw. While val is explicitly declared that\ncan be zero (in read mode), val2 is not specified to be non-zero.(CVE-2024-56567)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Create all dump files during debugfs initialization\n\nFor the current debugfs of hisi_sas, after user triggers dump, the\ndriver allocate memory space to save the register information and create\ndebugfs files to display the saved information. In this process, the\ndebugfs files created after each dump.\n\nTherefore, when the dump is triggered while the driver is unbind, the\nfollowing hang occurs:\n\n[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0\n[67840.862947] Mem abort info:\n[67840.865855]   ESR = 0x0000000096000004\n[67840.869713]   EC = 0x25: DABT (current EL), IL = 32 bits\n[67840.875125]   SET = 0, FnV = 0\n[67840.878291]   EA = 0, S1PTW = 0\n[67840.881545]   FSC = 0x04: level 0 translation fault\n[67840.886528] Data abort info:\n[67840.889524]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[67840.895117]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[67840.900284]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000\n[67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000\n[67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[67841.003628] pc : down_write+0x30/0x98\n[67841.007546] lr : start_creating.part.0+0x60/0x198\n[67841.012495] sp : ffff8000b979ba20\n[67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40\n[67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8\n[67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18\n[67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020\n[67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff\n[67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18\n[67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18\n[67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9\n[67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001\n[67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0\n[67841.089759] Call trace:\n[67841.092456]  down_write+0x30/0x98\n[67841.096017]  start_creating.part.0+0x60/0x198\n[67841.100613]  debugfs_create_dir+0x48/0x1f8\n[67841.104950]  debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw]\n[67841.111447]  debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw]\n[67841.118111]  debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw]\n[67841.125115]  full_proxy_write+0x68/0xc8\n[67841.129175]  vfs_write+0xd8/0x3f0\n[67841.132708]  ksys_write+0x70/0x108\n[67841.136317]  __arm64_sys_write+0x24/0x38\n[67841.140440]  invoke_syscall+0x50/0x128\n[67841.144385]  el0_svc_common.constprop.0+0xc8/0xf0\n[67841.149273]  do_el0_svc+0x24/0x38\n[67841.152773]  el0_svc+0x38/0xd8\n[67841.156009]  el0t_64_sync_handler+0xc0/0xc8\n[67841.160361]  el0t_64_sync+0x1a4/0x1a8\n[67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05)\n[67841.170443] ---[ end trace 0000000000000000 ]---\n\nTo fix this issue, create all directories and files during debugfs\ninitialization. In this way, the driver only needs to allocate memory\nspace to save information each time the user triggers dumping.(CVE-2024-56588)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Add cond_resched() for no forced preemption model\n\nFor no forced preemption model kernel, in the scenario where the\nexpander is connected to 12 high performance SAS SSDs, the following\ncall trace may occur:\n\n[  214.409199][  C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211]\n[  214.568533][  C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)\n[  214.575224][  C240] pc : fput_many+0x8c/0xdc\n[  214.579480][  C240] lr : fput+0x1c/0xf0\n[  214.583302][  C240] sp : ffff80002de2b900\n[  214.587298][  C240] x29: ffff80002de2b900 x28: ffff1082aa412000\n[  214.593291][  C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000\n[  214.599284][  C240] x25: ffff1062bbac5c40 x24: 0000000000001000\n[  214.605277][  C240] x23: 000000000000000a x22: 0000000000000001\n[  214.611270][  C240] x21: 0000000000001000 x20: 0000000000000000\n[  214.617262][  C240] x19: ffff3062a41ae580 x18: 0000000000010000\n[  214.623255][  C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0\n[  214.629248][  C240] x15: ffffffffffffffff x14: 0000000003ffffff\n[  214.635241][  C240] x13: 000000000000ffff x12: 000000000000029c\n[  214.641234][  C240] x11: 0000000000000006 x10: ffff80003a9f7fd0\n[  214.647226][  C240] x9 : ffffdb3a6f0482fc x8 : 0000000000000001\n[  214.653219][  C240] x7 : 0000000000000002 x6 : 0000000000000080\n[  214.659212][  C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554\n[  214.665205][  C240] x3 : 0000000000000002 x2 : 0000000000000020\n[  214.671198][  C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8\n[  214.677191][  C240] Call trace:\n[  214.680320][  C240]  fput_many+0x8c/0xdc\n[  214.684230][  C240]  fput+0x1c/0xf0\n[  214.687707][  C240]  aio_complete_rw+0xd8/0x1fc\n[  214.692225][  C240]  blkdev_bio_end_io+0x98/0x140\n[  214.696917][  C240]  bio_endio+0x160/0x1bc\n[  214.701001][  C240]  blk_update_request+0x1c8/0x3bc\n[  214.705867][  C240]  scsi_end_request+0x3c/0x1f0\n[  214.710471][  C240]  scsi_io_completion+0x7c/0x1a0\n[  214.715249][  C240]  scsi_finish_command+0x104/0x140\n[  214.720200][  C240]  scsi_softirq_done+0x90/0x180\n[  214.724892][  C240]  blk_mq_complete_request+0x5c/0x70\n[  214.730016][  C240]  scsi_mq_done+0x48/0xac\n[  214.734194][  C240]  sas_scsi_task_done+0xbc/0x16c [libsas]\n[  214.739758][  C240]  slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw]\n[  214.746185][  C240]  cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw]\n[  214.752179][  C240]  irq_thread_fn+0x34/0xa4\n[  214.756435][  C240]  irq_thread+0xc4/0x130\n[  214.760520][  C240]  kthread+0x108/0x13c\n[  214.764430][  C240]  ret_from_fork+0x10/0x18\n\nThis is because in the hisi_sas driver, both the hardware interrupt\nhandler and the interrupt thread are executed on the same CPU. In the\nperformance test scenario, function irq_wait_for_interrupt() will always\nreturn 0 if lots of interrupts occurs and the CPU will be continuously\nconsumed. As a result, the CPU cannot run the watchdog thread. When the\nwatchdog time exceeds the specified time, call trace occurs.\n\nTo fix it, add cond_resched() to execute the watchdog thread.(CVE-2024-56589)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb-\u0026gt;data.(CVE-2024-56590)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix OOB map writes when deleting elements\n\nJordy says:\n\n\u0026quot;\nIn the xsk_map_delete_elem function an unsigned integer\n(map-\u0026gt;max_entries) is compared with a user-controlled signed integer\n(k). Due to implicit type conversion, a large unsigned value for\nmap-\u0026gt;max_entries can bypass the intended bounds check:\n\n\tif (k \u0026gt;= map-\u0026gt;max_entries)\n\t\treturn -EINVAL;\n\nThis allows k to hold a negative value (between -2147483648 and -2),\nwhich is then used as an array index in m-\u0026gt;xsk_map[k], which results\nin an out-of-bounds access.\n\n\tspin_lock_bh(\u0026amp;m-\u0026gt;lock);\n\tmap_entry = \u0026amp;m-\u0026gt;xsk_map[k]; // Out-of-bounds map_entry\n\told_xs = unrcu_pointer(xchg(map_entry, NULL));  // Oob write\n\tif (old_xs)\n\t\txsk_map_sock_delete(old_xs, map_entry);\n\tspin_unlock_bh(\u0026amp;m-\u0026gt;lock);\n\nThe xchg operation can then be used to cause an out-of-bounds write.\nMoreover, the invalid map_entry passed to xsk_map_sock_delete can lead\nto further memory corruption.\n\u0026quot;\n\nIt indeed results in following splat:\n\n[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108\n[76612.904330] #PF: supervisor write access in kernel mode\n[76612.909639] #PF: error_code(0x0002) - not-present page\n[76612.914855] PGD 0 P4D 0\n[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP\n[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470\n[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019\n[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60\n[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff \u0026lt;48\u0026gt; 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31\n[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246\n[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000\n[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000\n[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007\n[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8\n[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0\n[76613.005303] FS:  00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000\n[76613.013517] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0\n[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[76613.041086] PKRU: 55555554\n[76613.043842] Call Trace:\n[76613.046331]  \u0026lt;TASK\u0026gt;\n[76613.048468]  ? __die+0x20/0x60\n[76613.051581]  ? page_fault_oops+0x15a/0x450\n[76613.055747]  ? search_extable+0x22/0x30\n[76613.059649]  ? search_bpf_extables+0x5f/0x80\n[76613.063988]  ? exc_page_fault+0xa9/0x140\n[76613.067975]  ? asm_exc_page_fault+0x22/0x30\n[76613.072229]  ? xsk_map_delete_elem+0x2d/0x60\n[76613.076573]  ? xsk_map_delete_elem+0x23/0x60\n[76613.080914]  __sys_bpf+0x19b7/0x23c0\n[76613.084555]  __x64_sys_bpf+0x1a/0x20\n[76613.088194]  do_syscall_64+0x37/0xb0\n[76613.091832]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[76613.096962] RIP: 0033:0x7f80b6d1e88d\n[76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141\n[76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d\n[76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003\n[76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000\n[76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8\n[76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00\n---truncated---(CVE-2024-56614)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use after free on unload\n\nSystem crash is observed with stack trace warning of use after\nfree. There are 2 signals to tell dpc_thread to terminate (UNLOADING\nflag and kthread_stop).\n\nOn setting the UNLOADING flag when dpc_thread happens to run at the time\nand sees the flag, this causes dpc_thread to exit and clean up\nitself. When kthread_stop is called for final cleanup, this causes use\nafter free.\n\nRemove UNLOADING signal to terminate dpc_thread.  Use the kthread_stop\nas the main signal to exit dpc_thread.\n\n[596663.812935] kernel BUG at mm/slub.c:294!\n[596663.812950] invalid opcode: 0000 [#1] SMP PTI\n[596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-240.el8.x86_64 #1\n[596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012\n[596663.812974] RIP: 0010:__slab_free+0x17d/0x360\n\n...\n[596663.813008] Call Trace:\n[596663.813022]  ? __dentry_kill+0x121/0x170\n[596663.813030]  ? _cond_resched+0x15/0x30\n[596663.813034]  ? _cond_resched+0x15/0x30\n[596663.813039]  ? wait_for_completion+0x35/0x190\n[596663.813048]  ? try_to_wake_up+0x63/0x540\n[596663.813055]  free_task+0x5a/0x60\n[596663.813061]  kthread_stop+0xf3/0x100\n[596663.813103]  qla2x00_remove_one+0x284/0x440 [qla2xxx](CVE-2024-56623)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix LGR and link use-after-free issue\n\nWe encountered a LGR/link use-after-free issue, which manifested as\nthe LGR/link refcnt reaching 0 early and entering the clear process,\nmaking resource access unsafe.\n\n refcount_t: addition on 0; use-after-free.\n WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140\n Workqueue: events smc_lgr_terminate_work [smc]\n Call trace:\n  refcount_warn_saturate+0x9c/0x140\n  __smc_lgr_terminate.part.45+0x2a8/0x370 [smc]\n  smc_lgr_terminate_work+0x28/0x30 [smc]\n  process_one_work+0x1b8/0x420\n  worker_thread+0x158/0x510\n  kthread+0x114/0x118\n\nor\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140\n Workqueue: smc_hs_wq smc_listen_work [smc]\n Call trace:\n  refcount_warn_saturate+0xf0/0x140\n  smcr_link_put+0x1cc/0x1d8 [smc]\n  smc_conn_free+0x110/0x1b0 [smc]\n  smc_conn_abort+0x50/0x60 [smc]\n  smc_listen_find_device+0x75c/0x790 [smc]\n  smc_listen_work+0x368/0x8a0 [smc]\n  process_one_work+0x1b8/0x420\n  worker_thread+0x158/0x510\n  kthread+0x114/0x118\n\nIt is caused by repeated release of LGR/link refcnt. One suspect is that\nsmc_conn_free() is called repeatedly because some smc_conn_free() from\nserver listening path are not protected by sock lock.\n\ne.g.\n\nCalls under socklock        | smc_listen_work\n-------------------------------------------------------\nlock_sock(sk)               | smc_conn_abort\nsmc_conn_free               | \\- smc_conn_free\n\\- smcr_link_put            |    \\- smcr_link_put (duplicated)\nrelease_sock(sk)\n\nSo here add sock lock protection in smc_listen_work() path, making it\nexclusive with other connection operations.(CVE-2024-56640)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: initialize close_work early to avoid warning\n\nWe encountered a warning that close_work was canceled before\ninitialization.\n\n  WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0\n  Workqueue: events smc_lgr_terminate_work [smc]\n  RIP: 0010:__flush_work+0x19e/0x1b0\n  Call Trace:\n   ? __wake_up_common+0x7a/0x190\n   ? work_busy+0x80/0x80\n   __cancel_work_timer+0xe3/0x160\n   smc_close_cancel_work+0x1a/0x70 [smc]\n   smc_close_active_abort+0x207/0x360 [smc]\n   __smc_lgr_terminate.part.38+0xc8/0x180 [smc]\n   process_one_work+0x19e/0x340\n   worker_thread+0x30/0x370\n   ? process_one_work+0x340/0x340\n   kthread+0x117/0x130\n   ? __kthread_cancel_work+0x50/0x50\n   ret_from_fork+0x22/0x30\n\nThis is because when smc_close_cancel_work is triggered, e.g. the RDMA\ndriver is rmmod and the LGR is terminated, the conn-\u0026gt;close_work is\nflushed before initialization, resulting in WARN_ON(!work-\u0026gt;func).\n\n__smc_lgr_terminate             | smc_connect_{rdma|ism}\n-------------------------------------------------------------\n                                | smc_conn_create\n\t\t\t\t| \\- smc_lgr_register_conn\nfor conn in lgr-\u0026gt;conns_all      |\n\\- smc_conn_kill                |\n   \\- smc_close_active_abort    |\n      \\- smc_close_cancel_work  |\n         \\- cancel_work_sync    |\n            \\- __flush_work     |\n\t         (close_work)   |\n\t                        | smc_close_init\n\t                        | \\- INIT_WORK(\u0026amp;close_work)\n\nSo fix this by initializing close_work before establishing the\nconnection.(CVE-2024-56641)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: avoid UAF in btmtk_process_coredump\n\nhci_devcd_append may lead to the release of the skb, so it cannot be\naccessed once it is called.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk]\nRead of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82\n\nCPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G     U             6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c\nHardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024\nWorkqueue: events btusb_rx_work [btusb]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xfd/0x150\n print_report+0x131/0x780\n kasan_report+0x177/0x1c0\n btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01]\n btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\n btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 82:\n stack_trace_save+0xdc/0x190\n kasan_set_track+0x4e/0x80\n __kasan_slab_alloc+0x4e/0x60\n kmem_cache_alloc+0x19f/0x360\n skb_clone+0x132/0xf70\n btusb_recv_acl_mtk+0x104/0x1a0 [btusb]\n btusb_rx_work+0x9e/0xe0 [btusb]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n\nFreed by task 1733:\n stack_trace_save+0xdc/0x190\n kasan_set_track+0x4e/0x80\n kasan_save_free_info+0x28/0xb0\n ____kasan_slab_free+0xfd/0x170\n kmem_cache_free+0x183/0x3f0\n hci_devcd_rx+0x91a/0x2060 [bluetooth]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n\nThe buggy address belongs to the object at ffff888033cfab40\n which belongs to the cache skbuff_head_cache of size 232\nThe buggy address is located 112 bytes inside of\n freed 232-byte region [ffff888033cfab40, ffff888033cfac28)\n\nThe buggy address belongs to the physical page:\npage:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa\nhead:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0x4000000000000840(slab|head|zone=1)\npage_type: 0xffffffff()\nraw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001\nraw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\n ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n\u0026gt;ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                     ^\n ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc\n ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nCheck if we need to call hci_devcd_complete before calling\nhci_devcd_append. That requires that we check data-\u0026gt;cd_info.cnt \u0026gt;=\nMTK_COREDUMP_NUM instead of data-\u0026gt;cd_info.cnt \u0026gt; MTK_COREDUMP_NUM, as we\nincrement data-\u0026gt;cd_info.cnt only once the call to hci_devcd_append\nsucceeds.(CVE-2024-56653)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()\n\nDuring early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,\nsince pageblock_order is still zero and it gets initialized\nlater during initmem_init() e.g.\nsetup_arch() -\u0026gt; initmem_init() -\u0026gt; sparse_init() -\u0026gt; set_pageblock_order()\n\nOne such use case where this causes issue is -\nearly_setup() -\u0026gt; early_init_devtree() -\u0026gt; fadump_reserve_mem() -\u0026gt; fadump_cma_init()\n\nThis causes CMA memory alignment check to be bypassed in\ncma_init_reserved_mem(). Then later cma_activate_area() can hit\na VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; order) - 1)) if the reserved memory\narea was not pageblock_order aligned.\n\nFix it by moving the fadump_cma_init() after initmem_init(),\nwhere other such cma reservations also gets called.\n\n\u0026lt;stack trace\u0026gt;\n==============\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010\nflags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA\nraw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; order) - 1))\n------------[ cut here ]------------\nkernel BUG at mm/page_alloc.c:778!\n\nCall Trace:\n__free_one_page+0x57c/0x7b0 (unreliable)\nfree_pcppages_bulk+0x1a8/0x2c8\nfree_unref_page_commit+0x3d4/0x4e4\nfree_unref_page+0x458/0x6d0\ninit_cma_reserved_pageblock+0x114/0x198\ncma_init_reserved_areas+0x270/0x3e0\ndo_one_initcall+0x80/0x2f8\nkernel_init_freeable+0x33c/0x530\nkernel_init+0x34/0x26c\nret_from_kernel_user_thread+0x14/0x1c(CVE-2024-56677)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: Fix hardware lockup on first Rx endpoint request\n\nThere is a possibility that a request\u0026apos;s callback could be invoked from\nusb_ep_queue() (call trace below, supplemented with missing calls):\n\nreq-\u0026gt;complete from usb_gadget_giveback_request\n\t(drivers/usb/gadget/udc/core.c:999)\nusb_gadget_giveback_request from musb_g_giveback\n\t(drivers/usb/musb/musb_gadget.c:147)\nmusb_g_giveback from rxstate\n\t(drivers/usb/musb/musb_gadget.c:784)\nrxstate from musb_ep_restart\n\t(drivers/usb/musb/musb_gadget.c:1169)\nmusb_ep_restart from musb_ep_restart_resume_work\n\t(drivers/usb/musb/musb_gadget.c:1176)\nmusb_ep_restart_resume_work from musb_queue_resume_work\n\t(drivers/usb/musb/musb_core.c:2279)\nmusb_queue_resume_work from musb_gadget_queue\n\t(drivers/usb/musb/musb_gadget.c:1241)\nmusb_gadget_queue from usb_ep_queue\n\t(drivers/usb/gadget/udc/core.c:300)\n\nAccording to the docstring of usb_ep_queue(), this should not happen:\n\n\u0026quot;Note that @req\u0026apos;s -\u0026gt;complete() callback must never be called from within\nusb_ep_queue() as that can create deadlock situations.\u0026quot;\n\nIn fact, a hardware lockup might occur in the following sequence:\n\n1. The gadget is initialized using musb_gadget_enable().\n2. Meanwhile, a packet arrives, and the RXPKTRDY flag is set, raising an\n   interrupt.\n3. If IRQs are enabled, the interrupt is handled, but musb_g_rx() finds an\n   empty queue (next_request() returns NULL). The interrupt flag has\n   already been cleared by the glue layer handler, but the RXPKTRDY flag\n   remains set.\n4. The first request is enqueued using usb_ep_queue(), leading to the call\n   of req-\u0026gt;complete(), as shown in the call trace above.\n5. If the callback enables IRQs and another packet is waiting, step (3)\n   repeats. The request queue is empty because usb_g_giveback() removes the\n   request before invoking the callback.\n6. The endpoint remains locked up, as the interrupt triggered by hardware\n   setting the RXPKTRDY flag has been handled, but the flag itself remains\n   set.\n\nFor this scenario to occur, it is only necessary for IRQs to be enabled at\nsome point during the complete callback. This happens with the USB Ethernet\ngadget, whose rx_complete() callback calls netif_rx(). If called in the\ntask context, netif_rx() disables the bottom halves (BHs). When the BHs are\nre-enabled, IRQs are also enabled to allow soft IRQs to be processed. The\ngadget itself is initialized at module load (or at boot if built-in), but\nthe first request is enqueued when the network interface is brought up,\ntriggering rx_complete() in the task context via ioctl(). If a packet\narrives while the interface is down, it can prevent the interface from\nreceiving any further packets from the USB host.\n\nThe situation is quite complicated with many parties involved. This\nparticular issue can be resolved in several possible ways:\n\n1. Ensure that callbacks never enable IRQs. This would be difficult to\n   enforce, as discovering how netif_rx() interacts with interrupts was\n   already quite challenging and u_ether is not the only function driver.\n   Similar \u0026quot;bugs\u0026quot; could be hidden in other drivers as well.\n2. Disable MUSB interrupts in musb_g_giveback() before calling the callback\n   and re-enable them afterwars (by calling musb_{dis,en}able_interrupts(),\n   for example). This would ensure that MUSB interrupts are not handled\n   during the callback, even if IRQs are enabled. In fact, it would allow\n   IRQs to be enabled when releasing the lock. However, this feels like an\n   inelegant hack.\n3. Modify the interrupt handler to clear the RXPKTRDY flag if the request\n   queue is empty. While this approach also feels like a hack, it wastes\n   CPU time by attempting to handle incoming packets when the software is\n   not ready to process them.\n4. Flush the Rx FIFO instead of calling rxstate() in musb_ep_restart().\n   This ensures that the hardware can receive packets when there is at\n   least one request in the queue. Once I\n---truncated---(CVE-2024-56687)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport\n\nSince transport-\u0026gt;sock has been set to NULL during reset transport,\nXPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the\nxs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request()\nto dereference the transport-\u0026gt;sock that has been set to NULL.(CVE-2024-56688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Fix dtl_access_lock to be a rw_semaphore\n\nThe dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because\nthe code calls kmalloc() while holding it, which can sleep:\n\n  # echo 1 \u0026gt; /proc/powerpc/vcpudispatch_stats\n  BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh\n  preempt_count: 1, expected: 0\n  3 locks held by sh/199:\n   #0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x324/0x438\n   #1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at: vcpudispatch_stats_write+0xd4/0x5f4\n   #2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at: vcpudispatch_stats_write+0x220/0x5f4\n  CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152\n  Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries\n  Call Trace:\n    dump_stack_lvl+0x130/0x148 (unreliable)\n    __might_resched+0x174/0x410\n    kmem_cache_alloc_noprof+0x340/0x3d0\n    alloc_dtl_buffers+0x124/0x1ac\n    vcpudispatch_stats_write+0x2a8/0x5f4\n    proc_reg_write+0xf4/0x150\n    vfs_write+0xfc/0x438\n    ksys_write+0x88/0x148\n    system_call_exception+0x1c4/0x5a0\n    system_call_common+0xf4/0x258(CVE-2024-56701)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: protect link down work from execute after lgr freed\n\nlink down work may be scheduled before lgr freed but execute\nafter lgr freed, which may result in crash. So it is need to\nhold a reference before shedule link down work, and put the\nreference after work executed or canceled.\n\nThe relevant crash call stack as follows:\n list_del corruption. prev-\u0026gt;next should be ffffb638c9c0fe20,\n    but was 0000000000000000\n ------------[ cut here ]------------\n kernel BUG at lib/list_debug.c:51!\n invalid opcode: 0000 [#1] SMP NOPTI\n CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1\n Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014\n Workqueue: events smc_link_down_work [smc]\n RIP: 0010:__list_del_entry_valid.cold+0x31/0x47\n RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086\n RAX: 0000000000000054 RBX: ffff942fb75e5128 RCX: 0000000000000000\n RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80\n RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb638c9c0fc38\n R10: ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: 0000000000000002\n R13: ffffb638c9c0fe20 R14: 0000000000000001 R15: ffff942f9cd051c0\n FS:  0000000000000000(0000) GS:ffff943520900000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  rwsem_down_write_slowpath+0x17e/0x470\n  smc_link_down_work+0x3c/0x60 [smc]\n  process_one_work+0x1ac/0x350\n  worker_thread+0x49/0x2f0\n  ? rescuer_thread+0x360/0x360\n  kthread+0x118/0x140\n  ? __kthread_bind_mask+0x60/0x60\n  ret_from_fork+0x1f/0x30(CVE-2024-56718)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Initialize cfid-\u0026gt;tcon before performing network ops\n\nAvoid leaking a tcon ref when a lease break races with opening the\ncached directory. Processing the leak break might take a reference to\nthe tcon in cached_dir_lease_break() and then fail to release the ref in\ncached_dir_offload_close, since cfid-\u0026gt;tcon is still NULL.(CVE-2024-56729)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: check folio mapping after unlock in relocate_one_folio()\n\nWhen we call btrfs_read_folio() to bring a folio uptodate, we unlock the\nfolio. The result of that is that a different thread can modify the\nmapping (like remove it with invalidate) before we call folio_lock().\nThis results in an invalid page and we need to try again.\n\nIn particular, if we are relocating concurrently with aborting a\ntransaction, this can result in a crash like the following:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  PGD 0 P4D 0\n  Oops: 0000 [#1] SMP\n  CPU: 76 PID: 1411631 Comm: kworker/u322:5\n  Workqueue: events_unbound btrfs_reclaim_bgs_work\n  RIP: 0010:set_page_extent_mapped+0x20/0xb0\n  RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246\n  RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880\n  RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0\n  R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000\n  R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff\n  FS:  0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die+0x78/0xc0\n  ? page_fault_oops+0x2a8/0x3a0\n  ? __switch_to+0x133/0x530\n  ? wq_worker_running+0xa/0x40\n  ? exc_page_fault+0x63/0x130\n  ? asm_exc_page_fault+0x22/0x30\n  ? set_page_extent_mapped+0x20/0xb0\n  relocate_file_extent_cluster+0x1a7/0x940\n  relocate_data_extent+0xaf/0x120\n  relocate_block_group+0x20f/0x480\n  btrfs_relocate_block_group+0x152/0x320\n  btrfs_relocate_chunk+0x3d/0x120\n  btrfs_reclaim_bgs_work+0x2ae/0x4e0\n  process_scheduled_works+0x184/0x370\n  worker_thread+0xc6/0x3e0\n  ? blk_add_timer+0xb0/0xb0\n  kthread+0xae/0xe0\n  ? flush_tlb_kernel_range+0x90/0x90\n  ret_from_fork+0x2f/0x40\n  ? flush_tlb_kernel_range+0x90/0x90\n  ret_from_fork_asm+0x11/0x20\n  \u0026lt;/TASK\u0026gt;\n\nThis occurs because cleanup_one_transaction() calls\ndestroy_delalloc_inodes() which calls invalidate_inode_pages2() which\ntakes the folio_lock before setting mapping to NULL. We fail to check\nthis, and subsequently call set_extent_mapping(), which assumes that\nmapping != NULL (in fact it asserts that in debug mode)\n\nNote that the \u0026quot;fixes\u0026quot; patch here is not the one that introduced the\nrace (the very first iteration of this code from 2009) but a more recent\nchange that made this particular crash happen in practice..(CVE-2024-56758)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg\n\nSyzbot reports [1] an uninitialized value issue found by KMSAN in\ndib3000_read_reg().\n\nLocal u8 rb[2] is used in i2c_transfer() as a read buffer; in case\nthat call fails, the buffer may end up with some undefined values.\n\nSince no elaborate error handling is expected in dib3000_write_reg(),\nsimply zero out rb buffer to mitigate the problem.\n\n[1] Syzkaller report\ndvb-usb: bulk message failed: -22 (6/0)\n=====================================================\nBUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31\n dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290\n dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]\n dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]\n dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310\n dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110\n...\nLocal variable rb created at:\n dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54\n dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n...(CVE-2024-56769)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur\n\nThe action force umount(umount -f) will attempt to kill all rpc_task even\numount operation may ultimately fail if some files remain open.\nConsequently, if an action attempts to open a file, it can potentially\nsend two rpc_task to nfs server.\n\n                   NFS CLIENT\nthread1                             thread2\nopen(\u0026quot;file\u0026quot;)\n...\nnfs4_do_open\n _nfs4_do_open\n  _nfs4_open_and_get_state\n   _nfs4_proc_open\n    nfs4_run_open_task\n     /* rpc_task1 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\n                                    umount -f\n                                    nfs_umount_begin\n                                     rpc_killall_tasks\n                                      rpc_signal_task\n     rpc_task1 been wakeup\n     and return -512\n _nfs4_do_open // while loop\n    ...\n    nfs4_run_open_task\n     /* rpc_task2 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\nWhile processing an open request, nfsd will first attempt to find or\nallocate an nfs4_openowner. If it finds an nfs4_openowner that is not\nmarked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since\ntwo rpc_task can attempt to open the same file simultaneously from the\nclient to server, and because two instances of nfsd can run\nconcurrently, this situation can lead to lots of memory leak.\nAdditionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be\ntriggered.\n\n                    NFS SERVER\nnfsd1                  nfsd2       echo 0 \u0026gt; /proc/fs/nfsd/threads\n\nnfsd4_open\n nfsd4_process_open1\n  find_or_alloc_open_stateowner\n   // alloc oo1, stateid1\n                       nfsd4_open\n                        nfsd4_process_open1\n                        find_or_alloc_open_stateowner\n                        // find oo1, without NFS4_OO_CONFIRMED\n                         release_openowner\n                          unhash_openowner_locked\n                          list_del_init(\u0026amp;oo-\u0026gt;oo_perclient)\n                          // cannot find this oo\n                          // from client, LEAK!!!\n                         alloc_stateowner // alloc oo2\n\n nfsd4_process_open2\n  init_open_stateid\n  // associate oo1\n  // with stateid1, stateid1 LEAK!!!\n  nfs4_get_vfs_file\n  // alloc nfsd_file1 and nfsd_file_mark1\n  // all LEAK!!!\n\n                         nfsd4_process_open2\n                         ...\n\n                                    write_threads\n                                     ...\n                                     nfsd_destroy_serv\n                                      nfsd_shutdown_net\n                                       nfs4_state_shutdown_net\n                                        nfs4_state_destroy_net\n                                         destroy_client\n                                          __destroy_client\n                                          // won\u0026apos;t find oo1!!!\n                                     nfsd_shutdown_generic\n                                      nfsd_file_cache_shutdown\n                                       kmem_cache_destroy\n                                       for nfsd_file_slab\n                                       and nfsd_file_mark_slab\n                                       // bark since nfsd_file1\n                                       // and nfsd_file_mark1\n                                       // still alive\n\n=======================================================================\nBUG nfsd_file (Not tainted): Objects remaining in nfsd_file on\n__kmem_cache_shutdown()\n-----------------------------------------------------------------------\n\nSlab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28\nflags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)\nCPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dum\n---truncated---(CVE-2024-56779)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: imx6: Fix suspend/resume support on i.MX6QDL\n\nThe suspend/resume functionality is currently broken on the i.MX6QDL\nplatform, as documented in the NXP errata (ERR005723):\n\n  https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf\n\nThis patch addresses the issue by sharing most of the suspend/resume\nsequences used by other i.MX devices, while avoiding modifications to\ncritical registers that disrupt the PCIe functionality. It targets the\nsame problem as the following downstream commit:\n\n  https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995\n\nUnlike the downstream commit, this patch also resets the connected PCIe\ndevice if possible. Without this reset, certain drivers, such as ath10k\nor iwlwifi, will crash on resume. The device reset is also done by the\ndriver on other i.MX platforms, making this patch consistent with\nexisting practices.\n\nUpon resuming, the kernel will hang and display an error. Here\u0026apos;s an\nexample of the error encountered with the ath10k driver:\n\n  ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible\n  Unhandled fault: imprecise external abort (0x1406) at 0x0106f944\n\nWithout this patch, suspend/resume will fail on i.MX6QDL devices if a\nPCIe device is connected.\n\n[kwilczynski: commit log, added tag for stable releases](CVE-2024-57809)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL\n\nCurrently tagged_addr_ctrl_set() doesn\u0026apos;t initialize the temporary \u0026apos;ctrl\u0026apos;\nvariable, and a SETREGSET call with a length of zero will leave this\nuninitialized. Consequently tagged_addr_ctrl_set() will consume an\narbitrary value, potentially leaking up to 64 bits of memory from the\nkernel stack. The read is limited to a specific slot on the stack, and\nthe issue does not provide a write mechanism.\n\nAs set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and\nrejects other values, a partial SETREGSET attempt will randomly succeed\nor fail depending on the value of the uninitialized value, and the\nexposure is significantly limited.\n\nFix this by initializing the temporary value before copying the regset\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\nvalue of the tagged address ctrl will be retained.\n\nThe NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the\nuser_aarch64_view used by a native AArch64 task to manipulate another\nnative AArch64 task. As get_tagged_addr_ctrl() only returns an error\nvalue when called for a compat task, tagged_addr_ctrl_get() and\ntagged_addr_ctrl_set() should never observe an error value from\nget_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that\nsuch an error would be unexpected, and error handlnig is not missing in\neither case.(CVE-2024-57874)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\n\nWhen mounting ocfs2 and then remounting it as read-only, a\nslab-use-after-free occurs after the user uses a syscall to\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u0026gt;dqi_priv is the\ndangling pointer.\n\nDuring the remounting process, the pointer dqi_priv is freed but is never\nset as null leaving it to be accessed.  Additionally, the read-only option\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\nnext quota, the function ocfs2_get_next_id is called and only checks the\nquota usage flags and not the quota suspended flags.\n\nTo fix this, I set dqi_priv to null when it is freed after remounting with\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\n\n[akpm@linux-foundation.org: coding-style cleanups](CVE-2024-57892)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ti-ads8688: fix information leak in triggered buffer\n\nThe \u0026apos;buffer\u0026apos; local array is used to push data to user space from a\ntriggered buffer, but it does not set values for inactive channels, as\nit only uses iio_for_each_active_channel() to assign new values.\n\nInitialize the array to zero before using it to avoid pushing\nuninitialized information to userspace.(CVE-2024-57906)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: light: vcnl4035: fix information leak in triggered buffer\n\nThe \u0026apos;buffer\u0026apos; local array is used to push data to userspace from a\ntriggered buffer, but it does not set an initial value for the single\ndata element, which is an u16 aligned to 8 bytes. That leaves at least\n4 bytes uninitialized even after writing an integer value with\nregmap_read().\n\nInitialize the array to zero before using it to avoid pushing\nuninitialized information to userspace.(CVE-2024-57910)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntopology: Keep the cpumask unchanged when printing cpumap\n\nDuring fuzz testing, the following warning was discovered:\n\n different return values (15 and 11) from vsnprintf(\u0026quot;%*pbl\n \u0026quot;, ...)\n\n test:keyward is WARNING in kvasprintf\n WARNING: CPU: 55 PID: 1168477 at lib/kasprintf.c:30 kvasprintf+0x121/0x130\n Call Trace:\n  kvasprintf+0x121/0x130\n  kasprintf+0xa6/0xe0\n  bitmap_print_to_buf+0x89/0x100\n  core_siblings_list_read+0x7e/0xb0\n  kernfs_file_read_iter+0x15b/0x270\n  new_sync_read+0x153/0x260\n  vfs_read+0x215/0x290\n  ksys_read+0xb9/0x160\n  do_syscall_64+0x56/0x100\n  entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe call trace shows that kvasprintf() reported this warning during the\nprinting of core_siblings_list. kvasprintf() has several steps:\n\n (1) First, calculate the length of the resulting formatted string.\n\n (2) Allocate a buffer based on the returned length.\n\n (3) Then, perform the actual string formatting.\n\n (4) Check whether the lengths of the formatted strings returned in\n     steps (1) and (2) are consistent.\n\nIf the core_cpumask is modified between steps (1) and (3), the lengths\nobtained in these two steps may not match. Indeed our test includes cpu\nhotplugging, which should modify core_cpumask while printing.\n\nTo fix this issue, cache the cpumask into a temporary variable before\ncalling cpumap_print_{list, cpumask}_to_buf(), to keep it unchanged\nduring the printing process.(CVE-2024-57917)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add check for granularity in dml ceil/floor helpers\n\n[Why]\nWrapper functions for dcn_bw_ceil2() and dcn_bw_floor2()\nshould check for granularity is non zero to avoid assert and\ndivide-by-zero error in dcn_bw_ functions.\n\n[How]\nAdd check for granularity 0.\n\n(cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec)(CVE-2024-57922)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Set private-\u0026gt;all_drm_private[i]-\u0026gt;drm to NULL if mtk_drm_bind returns err\n\nThe pointer need to be set to NULL, otherwise KASAN complains about\nuse-after-free. Because in mtk_drm_bind, all private\u0026apos;s drm are set\nas follows.\n\nprivate-\u0026gt;all_drm_private[i]-\u0026gt;drm = drm;\n\nAnd drm will be released by drm_dev_put in case mtk_drm_kms_init returns\nfailure. However, the shutdown path still accesses the previous allocated\nmemory in drm_atomic_helper_shutdown.\n\n[   84.874820] watchdog: watchdog0: watchdog did not stop!\n[   86.512054] ==================================================================\n[   86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378\n[   86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1\n[   86.515213]\n[   86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55\n[   86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022\n[   86.517960] Call trace:\n[   86.518333]  show_stack+0x20/0x38 (C)\n[   86.518891]  dump_stack_lvl+0x90/0xd0\n[   86.519443]  print_report+0xf8/0x5b0\n[   86.519985]  kasan_report+0xb4/0x100\n[   86.520526]  __asan_report_load8_noabort+0x20/0x30\n[   86.521240]  drm_atomic_helper_shutdown+0x33c/0x378\n[   86.521966]  mtk_drm_shutdown+0x54/0x80\n[   86.522546]  platform_shutdown+0x64/0x90\n[   86.523137]  device_shutdown+0x260/0x5b8\n[   86.523728]  kernel_restart+0x78/0xf0\n[   86.524282]  __do_sys_reboot+0x258/0x2f0\n[   86.524871]  __arm64_sys_reboot+0x90/0xd8\n[   86.525473]  invoke_syscall+0x74/0x268\n[   86.526041]  el0_svc_common.constprop.0+0xb0/0x240\n[   86.526751]  do_el0_svc+0x4c/0x70\n[   86.527251]  el0_svc+0x4c/0xc0\n[   86.527719]  el0t_64_sync_handler+0x144/0x168\n[   86.528367]  el0t_64_sync+0x198/0x1a0\n[   86.528920]\n[   86.529157] The buggy address belongs to the physical page:\n[   86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc\n[   86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff)\n[   86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000\n[   86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000\n[   86.534511] page dumped because: kasan: bad access detected\n[   86.535323]\n[   86.535559] Memory state around the buggy address:\n[   86.536265]  ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.537314]  ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.538363] \u0026gt;ffff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.544733]                                                           ^\n[   86.551057]  ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.557510]  ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.563928] ==================================================================\n[   86.571093] Disabling lock debugging due to kernel taint\n[   86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b\n[   86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f]\n...(CVE-2024-57926)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure shadow stack is active before \u0026quot;getting\u0026quot; registers\n\nThe x86 shadow stack support has its own set of registers. Those registers\nare XSAVE-managed, but they are \u0026quot;supervisor state components\u0026quot; which means\nthat userspace can not touch them with XSAVE/XRSTOR.  It also means that\nthey are not accessible from the existing ptrace ABI for XSAVE state.\nThus, there is a new ptrace get/set interface for it.\n\nThe regset code that ptrace uses provides an -\u0026gt;active() handler in\naddition to the get/set ones. For shadow stack this -\u0026gt;active() handler\nverifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the\nthread struct. The -\u0026gt;active() handler is checked from some call sites of\nthe regset get/set handlers, but not the ptrace ones. This was not\nunderstood when shadow stack support was put in place.\n\nAs a result, both the set/get handlers can be called with\nXFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to\nreturn NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an\nssp_active() check to avoid surprising the kernel with shadow stack\nbehavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That\ncheck just happened to avoid the warning.\n\nBut the -\u0026gt;get() side wasn\u0026apos;t so lucky. It can be called with shadow stacks\ndisabled, triggering the warning in practice, as reported by Christina\nSchimpe:\n\nWARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0\n[...]\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_regs+0x6e/0x80\n? ssp_get+0x89/0xa0\n? __warn+0x91/0x150\n? ssp_get+0x89/0xa0\n? report_bug+0x19d/0x1b0\n? handle_bug+0x46/0x80\n? exc_invalid_op+0x1d/0x80\n? asm_exc_invalid_op+0x1f/0x30\n? __pfx_ssp_get+0x10/0x10\n? ssp_get+0x89/0xa0\n? ssp_get+0x52/0xa0\n__regset_get+0xad/0xf0\ncopy_regset_to_user+0x52/0xc0\nptrace_regset+0x119/0x140\nptrace_request+0x13c/0x850\n? wait_task_inactive+0x142/0x1d0\n? do_syscall_64+0x6d/0x90\narch_ptrace+0x102/0x300\n[...]\n\nEnsure that shadow stacks are active in a thread before looking them up\nin the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are\nset at the same time, the active check ensures that there will be\nsomething to find in the XSAVE buffer.\n\n[ dhansen: changelog/subject tweaks ](CVE-2025-21632)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: avoid NULL pointer dereference if no valid extent tree\n\n[BUG]\nSyzbot reported a crash with the following call trace:\n\n  BTRFS info (device loop0): scrub: started on devid 1\n  BUG: kernel NULL pointer dereference, address: 0000000000000208\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0\n  Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206\n  Tainted: [O]=OOT_MODULE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]\n   scrub_simple_mirror+0x175/0x260 [btrfs]\n   scrub_stripe+0x5d4/0x6c0 [btrfs]\n   scrub_chunk+0xbb/0x170 [btrfs]\n   scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]\n   btrfs_scrub_dev+0x240/0x600 [btrfs]\n   btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]\n   ? do_sys_openat2+0xa5/0xf0\n   __x64_sys_ioctl+0x97/0xc0\n   do_syscall_64+0x4f/0x120\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\n[CAUSE]\nThe reproducer is using a corrupted image where extent tree root is\ncorrupted, thus forcing to use \u0026quot;rescue=all,ro\u0026quot; mount option to mount the\nimage.\n\nThen it triggered a scrub, but since scrub relies on extent tree to find\nwhere the data/metadata extents are, scrub_find_fill_first_stripe()\nrelies on an non-empty extent root.\n\nBut unfortunately scrub_find_fill_first_stripe() doesn\u0026apos;t really expect\nan NULL pointer for extent root, it use extent_root to grab fs_info and\ntriggered a NULL pointer dereference.\n\n[FIX]\nAdd an extra check for a valid extent root at the beginning of\nscrub_find_fill_first_stripe().\n\nThe new error path is introduced by 42437a6386ff (\u0026quot;btrfs: introduce\nmount option rescue=ignorebadroots\u0026quot;), but that\u0026apos;s pretty old, and later\ncommit b979547513ff (\u0026quot;btrfs: scrub: introduce helper to find and fill\nsector info for a scrub_stripe\u0026quot;) changed how we do scrub.\n\nSo for kernels older than 6.6, the fix will need manual backport.(CVE-2025-21658)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/bpf: return early if transport is not assigned\n\nSome of the core functions can only be called if the transport\nhas been assigned.\n\nAs Michal reported, a socket might have the transport at NULL,\nfor example after a failed connect(), causing the following trace:\n\n    BUG: kernel NULL pointer dereference, address: 00000000000000a0\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0\n    Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n    CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+\n    RIP: 0010:vsock_connectible_has_data+0x1f/0x40\n    Call Trace:\n     vsock_bpf_recvmsg+0xca/0x5e0\n     sock_recvmsg+0xb9/0xc0\n     __sys_recvfrom+0xb3/0x130\n     __x64_sys_recvfrom+0x20/0x30\n     do_syscall_64+0x93/0x180\n     entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nSo we need to check the `vsk-\u0026gt;transport` in vsock_bpf_recvmsg(),\nespecially for connected sockets (stream/seqpacket) as we already\ndo in __vsock_connectible_recvmsg().(CVE-2025-21670)","status":"published","published":"2025-02-08T11:08:11Z","modified":"2026-08-18T01:18:47.021739645Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-53201","description":"In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe This commit addresses a null pointer dereference issue in dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 (\"drm/amd/display: Add null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\") partially fixed the null pointer dereference issue. However, in dcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and plane_state is accessed again through pipe_ctx. Multiple if statements directly call attributes of plane_state, leading to potential null pointer dereference issues. This patch adds necessary null checks to ensure stability.","status":"published","published":"2024-12-27T14:15:00Z","modified":"2026-04-22T15:20:49.953489Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"SUSE-SU-2025:0117-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (bsc#1234282).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Force position-independent veneers (git-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-throttle: fix lockdep warning of 'cgroup_mutex or RCU read lock required!' (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- checkpatch: always parse orig_commit in fixes tag (git-fixes).\n- checkpatch: check for missing Fixes tags (stable-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (https://bugzilla.kernel.org/show_bug.cgi?id=216322 bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (tmp513) Do not use 'proxy' headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix 'ghost' detections (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- ice: Unbind the workqueue (bsc#1234989)\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/qed: allow old cards not supporting 'num_images' to work (git-fixes).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-01-15T09:07:49Z","modified":"2026-02-04T04:29:15.481537Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0153-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- Revert 'block/mq-deadline: use correct way to throttling write requests' (bsc#1234146).\n- Revert 'btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)'\n- Revert 'igb: Disable threaded IRQ for igb_msix_other' (git-fixes).\n- Revert 'unicode: Do not special case ignorable code points' (stable-fixes).\n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of 'cgroup_mutex or RCU read lock required!' (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (https://bugzilla.kernel.org/show_bug.cgi?id=216322 bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use 'proxy' headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix 'ghost' detections (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting 'num_images' to work (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-01-17T09:14:12Z","modified":"2026-02-04T04:01:47.280553Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0154-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (XSA-465 bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- Revert 'block/mq-deadline: use correct way to throttling write requests' (bsc#1234146).\n- Revert 'btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)'\n- Revert 'igb: Disable threaded IRQ for igb_msix_other' (git-fixes).\n- Revert 'mm, kmsan: fix infinite recursion due to RCU critical section' (bsc#1230413)\n- Revert 'mm/sparsemem: fix race in accessing memory_section-\u003eusage' (bsc#1230413)\n- Revert 'mm: prevent derefencing NULL ptr in pfn_section_valid()' (bsc#1230413)\n- Revert 'unicode: Do not special case ignorable code points' (stable-fixes).\n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of 'cgroup_mutex or RCU read lock required!' (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- checkpatch: always parse orig_commit in fixes tag (git-fixes).\n- checkpatch: check for missing Fixes tags (stable-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (https://bugzilla.kernel.org/show_bug.cgi?id=216322 bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use 'proxy' headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix 'ghost' detections (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting 'num_images' to work (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-01-17T09:15:09Z","modified":"2026-02-04T03:56:25.179711Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0289-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).\n- CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).\n- CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).\n- CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).\n- CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).\n- CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).\n- CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).\n- CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).\n- CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).\n- CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50252: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (bsc#1233201).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).\n- CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).\n- CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).\n- CVE-2024-53043: mctp i2c: handle NULL header address (bsc#1233523).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).\n- CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).\n- CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53110: vp_vdpa: fix id_table array not null terminated error (bsc#1234085).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53121: net/mlx5: fs, lock FTE when checking if active (bsc#1234078).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53138: net/mlx5e: kTLS, Fix incorrect page refcounting (bsc#1234223).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).\n- CVE-2024-53170: block: fix uaf for flush rq while iterating tags (bsc#1234888).\n- CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).\n- CVE-2024-53175: ipc: fix memleak if msg_init_ns failed in create_ipc_ns (bsc#1234893).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey() (bsc#1234901).\n- CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use (bsc#1234957).\n- CVE-2024-53196: KVM: arm64: Do not retire aborted MMIO instruction (bsc#1234906).\n- CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit() (bsc#1235011).\n- CVE-2024-53232: iommu/s390: Implement blocking domain (bsc#1235050).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53236: xsk: Free skb when TX metadata options are invalid (bsc#1235000).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-53685: ceph: give up on paths longer than PATH_MAX (bsc#1235720).\n- CVE-2024-55639: net: renesas: rswitch: avoid use-after-put for a device tree node (bsc#1235737).\n- CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit() (bsc#1235745).\n- CVE-2024-56372: net: tun: fix tun_napi_alloc_frags() (bsc#1235753).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).\n- CVE-2024-56569: ftrace: Fix regression with module command in stack_trace_filter (bsc#1235031).\n- CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization (bsc#1235123).\n- CVE-2024-56589: scsi: hisi_sas: Add cond_resched() for no forced preemption model (bsc#1235241).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56602: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (bsc#1235521).\n- CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create() (bsc#1235415).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235061).\n- CVE-2024-56611: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (bsc#1235391).\n- CVE-2024-56614: xsk: fix OOB map writes when deleting elements (bsc#1235424).\n- CVE-2024-56615: bpf: fix OOB devmap writes when deleting elements (bsc#1235426).\n- CVE-2024-56617: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU (bsc#1235429).\n- CVE-2024-56620: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled (bsc#1235227).\n- CVE-2024-56622: scsi: ufs: core: sysfs: Prevent div by zero (bsc#1235251).\n- CVE-2024-56631: scsi: sg: Fix slab-use-after-free read in sg_release() (bsc#1235480).\n- CVE-2024-56635: net: avoid potential UAF in default_operstate() (bsc#1235519).\n- CVE-2024-56636: geneve: do not assume mac header is set in geneve_xmit_skb() (bsc#1235520).\n- CVE-2024-56637: netfilter: ipset: Hold module reference while requesting a module (bsc#1235523).\n- CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).\n- CVE-2024-56643: dccp: Fix memory leak in dccp_feat_change_recv (bsc#1235132).\n- CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fill_frame_info() (bsc#1235451).\n- CVE-2024-56649: net: enetc: Do not configure preemptible TCs if SIs do not support (bsc#1235449).\n- CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips (bsc#1235444).\n- CVE-2024-56659: net: lapb: increase LAPB_HEADER_LEN (bsc#1235439).\n- CVE-2024-56660: net/mlx5: DR, prevent potential error pointer dereference (bsc#1235437).\n- CVE-2024-56664: bpf, sockmap: Fix race between element replace and close() (bsc#1235249).\n- CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (bsc#1235555).\n- CVE-2024-56694: bpf: fix recursive lock when verdict program return SK_PASS (bsc#1235412).\n- CVE-2024-56704: 9p/xen: fix release of IRQ (bsc#1235584).\n- CVE-2024-56708: EDAC/igen6: Avoid segmentation fault on module unload (bsc#1235564).\n- CVE-2024-56712: udmabuf: fix memory leak on last export_udmabuf() error path (bsc#1235565).\n- CVE-2024-56716: netdevsim: prevent bad user input in nsim_dev_health_break_write() (bsc#1235587).\n- CVE-2024-56729: smb: Initialize cfid-\u003etcon before performing network ops (bsc#1235503).\n- CVE-2024-56747: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (bsc#1234934).\n- CVE-2024-56748: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (bsc#1235627).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n- CVE-2024-56759: btrfs: fix use-after-free when COWing tree bock and tracing is enabled (bsc#1235645).\n- CVE-2024-56774: btrfs: add a sanity check for btrfs root in btrfs_search_slot() (bsc#1235653).\n- CVE-2024-56775: drm/amd/display: Fix handling of plane refcount (bsc#1235657).\n- CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data (bsc#1235759).\n- CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235768).\n- CVE-2024-57795: RDMA/rxe: Remove the direct link to net_device (bsc#1235906).\n- CVE-2024-57801: net/mlx5e: Skip restore TC rules for vport rep without loaded flag (bsc#1235940).\n- CVE-2024-57804: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (bsc#1235779).\n- CVE-2024-57809: PCI: imx6: Fix suspend/resume support on i.MX6QDL (bsc#1235793).\n- CVE-2024-57838: s390/entry: Mark IRQ entries to fix stack depot warnings (bsc#1235798).\n- CVE-2024-57857: RDMA/siw: Remove direct link to net_device (bsc#1235946).\n- CVE-2024-57892: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (bsc#1235964).\n- CVE-2024-57896: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (bsc#1235965).\n- CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets (bsc#1235967).\n- CVE-2024-57929: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (bsc#1236096).\n- CVE-2024-57932: gve: guard XDP xmit NDO on existence of xdp queues (bsc#1236190).\n- CVE-2024-57933: gve: guard XSK operations on the existence of queues (bsc#1236178).\n- CVE-2025-21632: x86/fpu: Ensure shadow stack is active before 'getting' registers (bsc#1236106).\n- CVE-2025-21649: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (bsc#1236143).\n- CVE-2025-21650: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue (bsc#1236144).\n- CVE-2025-21651: net: hns3: do not auto enable misc vector (bsc#1236145).\n- CVE-2025-21662: net/mlx5: Fix variable not being completed when function returns (bsc#1236198).\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A (stable-fixes).\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 (stable-fixes).\n- ACPI: PCC: Add PCC shared memory region command and status bitfields (stable-fixes).\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] (stable-fixes).\n- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] (stable-fixes).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/conexant: fix Z60MR100 startup pop issue (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model (stable-fixes).\n- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA (stable-fixes).\n- ALSA: hda/realtek: Add support for Galaxy Book2 Pro (NP950XEE) (stable-fixes).\n- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG) (stable-fixes).\n- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ALSA: usb-audio: add mixer mapping for Corsair HS80 (stable-fixes).\n- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post() (stable-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: ipc3-topology: fix resource leaks in sof_ipc3_widget_setup_comp_dai() (git-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: mediatek: disable buffer pre-allocation (stable-fixes).\n- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec (git-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: rt722: add delay time to wait for the calibration procedure (stable-fixes).\n- Bluetooth: Add support ITTIM PE50-M75C (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: MGMT: Fix Add Device to responding before completing (git-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btnxpuart: Fix driver sending truncated data (git-fixes).\n- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 (stable-fixes).\n- Bluetooth: btusb: add callback function in btusb suspend/resume (stable-fixes).\n- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: hci_sync: Fix not setting Random Address when required (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Disable ceph (jsc#PED-7242)\n- Documentation/virt/kvm: Document on Trust Domain Extensions(TDX) (jsc#PED-6143).\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- Drop uvcvideo fix due to regression (bsc#1235894)\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- HID: wacom: fix when get product name maybe null pointer (git-fixes).\n- Input: bbnsm_pwrkey - fix missed key press after suspend (git-fixes).\n- KVM: Fix conflict of IOCTL definition of KVM_MEMORY_MAPPING (jsc#PED-6143).\n- KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits (bsc#1234635).\n- KVM: TDX: Add KVM Exit for TDX TDG.VP.VMCALL (jsc#PED-6143).\n- KVM: TDX: Add TSX_CTRL msr into uret_msrs list (jsc#PED-6143).\n- KVM: TDX: Add a method to ignore dirty logging (jsc#PED-6143).\n- KVM: TDX: Add a method to ignore for TDX to ignore hypercall patch (jsc#PED-6143).\n- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (jsc#PED-6143).\n- KVM: TDX: Add a place holder to handle TDX VM exit (jsc#PED-6143).\n- KVM: TDX: Add accessors VMX VMCS helpers (jsc#PED-6143).\n- KVM: TDX: Add helper function to read TDX metadata in array (jsc#PED-6143).\n- KVM: TDX: Add helper functions to allocate/free TDX private host key id (jsc#PED-6143).\n- KVM: TDX: Add is_private check for mmu_alloc_root (jsc#PED-6143).\n- KVM: TDX: Add load_mmu_pgd method for TDX (jsc#PED-6143).\n- KVM: TDX: Add methods to ignore VMX preemption timer (jsc#PED-6143).\n- KVM: TDX: Add methods to ignore accesses to TSC (jsc#PED-6143).\n- KVM: TDX: Add methods to ignore guest instruction emulation (jsc#PED-6143).\n- KVM: TDX: Add methods to ignore virtual apic related operation (jsc#PED-6143).\n- KVM: TDX: Add support for find pending IRQ in a protected local APIC (jsc#PED-6143).\n- KVM: TDX: Complete interrupts after tdexit (jsc#PED-6143).\n- KVM: TDX: Create initial guest memory (jsc#PED-6143).\n- KVM: TDX: Do TDX specific vcpu initialization (jsc#PED-6143).\n- KVM: TDX: Do not use NO_RBP_MOD for backward compatibility (jsc#PED-6143).\n- KVM: TDX: Emulate Xen MTRR disablement (jsc#PED-6143).\n- KVM: TDX: Extend memory measurement with initial guest memory (jsc#PED-6143).\n- KVM: TDX: Finalize VM initialization (jsc#PED-6143).\n- KVM: TDX: Fix incompatibility with QEMU definition (jsc#PED-6143).\n- KVM: TDX: Fix is_private for page fault handler (jsc#PED-6143).\n- KVM: TDX: Get system-wide info about TDX module on initialization (jsc#PED-6143).\n- KVM: TDX: Handle EXIT_REASON_OTHER_SMI with MSMI (jsc#PED-6143).\n- KVM: TDX: Handle MSR IA32_FEAT_CTL MSR and IA32_MCG_EXT_CTL (jsc#PED-6143).\n- KVM: TDX: Handle MSR MTRRCap and MTRRDefType access (jsc#PED-6143).\n- KVM: TDX: Handle TDG.VP.VMCALL\u0026lt;GetTdVmCallInfo\u003e hypercall (jsc#PED-6143).\n- KVM: TDX: Handle TDX PV CPUID hypercall (jsc#PED-6143).\n- KVM: TDX: Handle TDX PV HLT hypercall (jsc#PED-6143).\n- KVM: TDX: Handle TDX PV MMIO hypercall (jsc#PED-6143).\n- KVM: TDX: Handle TDX PV port io hypercall (jsc#PED-6143).\n- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (jsc#PED-6143).\n- KVM: TDX: Handle vmentry failure for INTEL TD guest (jsc#PED-6143).\n- KVM: TDX: Ignore setting up mce (jsc#PED-6143).\n- KVM: TDX: Implement TDX vcpu enter/exit path (jsc#PED-6143).\n- KVM: TDX: Implement callbacks for MSR operations for TDX (jsc#PED-6143).\n- KVM: TDX: Implement interrupt injection (jsc#PED-6143).\n- KVM: TDX: Implement methods to inject NMI (jsc#PED-6143).\n- KVM: TDX: Inhibit APICv for TDX guest (jsc#PED-6143).\n- KVM: TDX: MTRR: implement get_mt_mask() for TDX (jsc#PED-6143).\n- KVM: TDX: Make KVM_CAP_MAX_VCPUS backend specific (jsc#PED-6143).\n- KVM: TDX: Make pmu_intel.c ignore guest TD case (jsc#PED-6143).\n- KVM: TDX: Refuse to unplug the last cpu on the package (jsc#PED-6143).\n- KVM: TDX: Require TDP MMU and mmio caching for TDX (jsc#PED-6143).\n- KVM: TDX: Retry seamcall when TDX_OPERAND_BUSY with operand SEPT (jsc#PED-6143).\n- KVM: TDX: Return -EINTR for KVM_MEMORY_MAPPING when signal pending (jsc#PED-6143).\n- KVM: TDX: Silently discard SMI request (jsc#PED-6143).\n- KVM: TDX: Silently ignore INIT/SIPI (jsc#PED-6143).\n- KVM: TDX: TDP MMU TDX support (jsc#PED-6143).\n- KVM: TDX: create/destroy VM structure (jsc#PED-6143).\n- KVM: TDX: create/free TDX vcpu structure (jsc#PED-6143).\n- KVM: TDX: handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (jsc#PED-6143).\n- KVM: TDX: handle EXIT_REASON_OTHER_SMI (jsc#PED-6143).\n- KVM: TDX: handle KVM hypercall with TDG.VP.VMCALL (jsc#PED-6143).\n- KVM: TDX: handle ept violation/misconfig exit (jsc#PED-6143).\n- KVM: TDX: handle vcpu migration over logical processor (jsc#PED-6143).\n- KVM: TDX: initialize VM with TDX specific parameters (jsc#PED-6143).\n- KVM: TDX: remove use of struct vcpu_vmx from posted_interrupt.c (jsc#PED-6143).\n- KVM: TDX: restore debug store when TD exit (jsc#PED-6143).\n- KVM: TDX: restore host xsave state when exit from the guest TD (jsc#PED-6143).\n- KVM: TDX: restore user ret MSRs (jsc#PED-6143).\n- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (jsc#PED-6143).\n- KVM: TDX: x86: Add ioctl to get TDX systemwide parameters (jsc#PED-6143).\n- KVM: VMX: Move NMI/exception handler to common helper (jsc#PED-6143).\n- KVM: VMX: Split out guts of EPT violation to common/exposed function (jsc#PED-6143).\n- KVM: s390: Reject KVM_SET_GSI_ROUTING on ucontrol VMs (git-fixes bsc#1235776).\n- KVM: s390: Reject setting flic pfault attributes on ucontrol VMs (git-fixes bsc#1235777).\n- KVM: s390: vsie: fix virtual/physical address in unpin_scb() (git-fixes bsc#1235778).\n- KVM: x86/mmu: Add a new is_private member for union kvm_mmu_page_role (jsc#PED-6143).\n- KVM: x86/mmu: Add a private pointer to struct kvm_mmu_page (jsc#PED-6143).\n- KVM: x86/mmu: Add address conversion functions for TDX shared bit of GPA (jsc#PED-6143).\n- KVM: x86/mmu: Alloc TDP MMU roots while holding mmu_lock for read (jsc#PED-6143).\n- KVM: x86/mmu: Allow passing '-1' for 'all' as_id for TDP MMU iterators (jsc#PED-6143).\n- KVM: x86/mmu: Check for usable TDP MMU root while holding mmu_lock for read (jsc#PED-6143).\n- KVM: x86/mmu: Disallow fast page fault on private GPA (jsc#PED-6143).\n- KVM: x86/mmu: Do not do TLB flush when zappings SPTEs in invalid roots (jsc#PED-6143).\n- KVM: x86/mmu: Do not enable page track for TD guest (jsc#PED-6143).\n- KVM: x86/mmu: Free TDP MMU roots while holding mmy_lock for read (jsc#PED-6143).\n- KVM: x86/mmu: Precisely invalidate MMU root_role during CPUID update (git-fixes).\n- KVM: x86/mmu: Skip invalid TDP MMU roots when write-protecting SPTEs (jsc#PED-6143).\n- KVM: x86/mmu: Skip invalid roots when zapping leaf SPTEs for GFN range (jsc#PED-6143).\n- KVM: x86/mmu: Zap invalidated TDP MMU roots at 4KiB granularity (jsc#PED-6143).\n- KVM: x86/tdp_mmu: Apply mmu notifier callback to only shared GPA (jsc#PED-6143).\n- KVM: x86/tdp_mmu: Do not zap private pages for unsupported cases (jsc#PED-6143).\n- KVM: x86/tdp_mmu: Fix to return original flush on unsupported cases (jsc#PED-6143).\n- KVM: x86/tdp_mmu: Init role member of struct kvm_mmu_page at allocation (jsc#PED-6143).\n- KVM: x86/tdp_mmu: Support TDX private mapping for TDP MMU (jsc#PED-6143).\n- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (jsc#PED-6143).\n- KVM: x86: Add hooks in kvm_arch_vcpu_memory_mapping() (jsc#PED-6143).\n- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (jsc#PED-6143).\n- KVM: x86: Assume timer IRQ was injected if APIC state is proteced (jsc#PED-6143).\n- KVM: x86: Split core of hypercall emulation to helper function (jsc#PED-6143).\n- KVM: x86: design documentation on TDX support of x86 KVM TDP MMU (jsc#PED-6143).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Add send queue size check for variable wqe (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix MSN table size for variable wqe mode (git-fixes)\n- RDMA/bnxt_re: Fix max SGEs for the Work Request (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Fix the max WQE size for static WQE support (git-fixes)\n- RDMA/bnxt_re: Fix the max WQEs used in Static WQE mode (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- RFC: KVM: x86, TDX: Add check for KVM_SET_CPUID2 (jsc#PED-6143).\n- RFC: KVM: x86: Add x86 callback to check cpuid (jsc#PED-6143).\n- Revert 'block/mq-deadline: use correct way to throttling write requests' (bsc#1234146).\n- Revert 'btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)'\n- Revert 'igb: Disable threaded IRQ for igb_msix_other' (git-fixes).\n- Revert 'mm, kmsan: fix infinite recursion due to RCU critical section' (bsc#1230413)\n- Revert 'mm/sparsemem: fix race in accessing memory_section-\u003eusage' (bsc#1230413)\n- Revert 'mm: prevent derefencing NULL ptr in pfn_section_valid()' (bsc#1230413)\n- Revert 'mtd: spi-nor: core: replace dummy buswidth from addr to data' (git-fixes).\n- Revert 'unicode: Do not special case ignorable code points' (stable-fixes).\n- Revert 'arm64: Kconfig: Make SME depend on BROKEN for now'\n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: core: Disable LPM only for non-suspended ports (git-fixes).\n- USB: serial: cp210x: add Phoenix Contact UPS Device (stable-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM815 (stable-fixes).\n- USB: serial: option: add Neoway N723-EA support (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- USB: usblp: return error when setting unsupported protocol (git-fixes).\n- VM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (jsc#PED-6143).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- afs: Fix the maximum cell name length (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes).\n- arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer (git-fixes)\n- arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay (git-fixes)\n- arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay (git-fixes)\n- arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs (git-fixes)\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- arm64: dts: imx8qxp: Add VPU subsystem file (git-fixes)\n- arm64: dts: imx93: add nvmem property for eqos (git-fixes)\n- arm64: dts: imx93: add nvmem property for fec1 (git-fixes)\n- arm64: dts: imx93: add ocotp node (git-fixes)\n- arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus (git-fixes)\n- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)\n- arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc (git-fixes)\n- arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards (git-fixes)\n- arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo (git-fixes)\n- arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes (git-fixes)\n- arm64: dts: rockchip: Fix rt5651 compatible value on (git-fixes)\n- arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610 (git-fixes)\n- arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node (git-fixes)\n- arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma (git-fixes)\n- arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 (git-fixes)\n- arm64: dts: rockchip: Remove undocumented supports-emmc property (git-fixes)\n- arm64: dts: rockchip: add hevc power domain clock to rk3328 (git-fixes).\n- arm64: dts: rockchip: fix i2c2 pinctrl-names property on (git-fixes)\n- arm64: dts: rockchip: remove num-slots property from (git-fixes)\n- arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone (git-fixes)\n- arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes)\n- arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL (git-fixes).\n- arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes)\n- arm64: smccc: replace custom COUNT_ARGS() \u0026 CONCATENATE() (git-fixes)\n- arm64: tegra: Move AGX Orin nodes to correct location (git-fixes)\n- arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes)\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of 'cgroup_mutex or RCU read lock required!' (bsc#1234140).\n- blk-wbt-Fix-detection-of-dirty-throttled-tasks.patch: Update tags\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (git-fixes)\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, arm64: Fix address emission with tag-based KASAN enabled (git-fixes)\n- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235445).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235445).\n- can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes).\n- can: dev: can_set_termination(): allow sleeping GPIOs (git-fixes).\n- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes).\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: hi311x: hi3110_can_ist(): fix potential use-after-free (git-fixes).\n- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics (git-fixes).\n- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- can: j1939: j1939_session_new(): fix skb reference counting (git-fixes).\n- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes).\n- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6 (git-fixes).\n- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics (git-fixes).\n- can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes).\n- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes).\n- ceph: improve error handling and short/overflow-read logic in __ceph_sync_read() (bsc#1228592).\n- cleanup: Add conditional guard support (stable-fixes).\n- cleanup: Adjust scoped_guard() macros to avoid potential warning (stable-fixes).\n- cleanup: Remove address space of returned pointer (git-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization (bsc#1234619).\n- cpufreq: intel_pstate: Drop redundant locking from intel_pstate_driver_cleanup() (bsc#1234619).\n- cpufreq: intel_pstate: Fix unchecked HWP MSR access (bsc#1234619).\n- cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller (bsc#1234619).\n- cpufreq: intel_pstate: Get rid of unnecessary READ_ONCE() annotations (bsc#1234619).\n- cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE() (bsc#1234619).\n- cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Refine computation of P-state for given frequency (bsc#1234619).\n- cpufreq: intel_pstate: Replace three global.turbo_disabled checks (bsc#1234619).\n- cpufreq: intel_pstate: Revise global turbo disable check (bsc#1234619).\n- cpufreq: intel_pstate: Simplify spinlock locking (bsc#1234619).\n- cpufreq: intel_pstate: Update the maximum CPU frequency consistently (bsc#1234619).\n- cpufreq: intel_pstate: Use __ro_after_init for three variables (bsc#1234619).\n- cpufreq: intel_pstate: Wait for canceled delayed work to complete (bsc#1234619).\n- crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes (git-fixes).\n- crypto: ecdsa - Avoid signed integer overflow on signature decoding (stable-fixes).\n- crypto: ecdsa - Convert byte arrays with key coordinates to digits (stable-fixes).\n- crypto: ecdsa - Rename keylen to bufsize where necessary (stable-fixes).\n- crypto: ecdsa - Use ecc_digits_from_bytes to convert signature (stable-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dlm: fix possible lkb_resource null dereference (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dma-fence: Fix reference leak on fence merge failure path (git-fixes).\n- dma-fence: Use kernel's sort for merging fences (git-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Add check for granularity in dml ceil/floor helpers (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix DSC-re-computing (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Fix incorrect DSC recompute trigger (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/display: increase MAX_SURFACES to the value supported by hw (stable-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdkfd: Correct the migration DMA map direction (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: fixed page fault when enable MES shader debugger (git-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/mediatek: Add return value check when reading DPCD (git-fixes).\n- drm/mediatek: Add support for 180-degree rotation in the display driver (git-fixes).\n- drm/mediatek: Fix YCbCr422 color format issue for DP (git-fixes).\n- drm/mediatek: Fix mode valid issue for dp (git-fixes).\n- drm/mediatek: Set private-\u003eall_drm_private[i]-\u003edrm to NULL if mtk_drm_bind returns err (git-fixes).\n- drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188 (git-fixes).\n- drm/mediatek: stop selecting foreign drivers (git-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).\n- drm/v3d: Enable Performance Counters before clearing them (git-fixes).\n- drm/v3d: Ensure job pointer is set to NULL after job completion (git-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm/vmwgfx: Add new keep_resv BO param (git-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: ensure that ctime is updated whenever the mtime is (git-fixes).\n- exfat: fix the infinite loop in __exfat_free_cluster() (git-fixes).\n- exfat: fix the infinite loop in exfat_readdir() (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (https://bugzilla.kernel.org/show_bug.cgi?id=216322 bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- gpio: xilinx: Convert gpio_lock to raw spinlock (git-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur (git-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use 'proxy' headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix division of negative numbers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- i2c: core: fix reference leak in i2c_register_adapter() (git-fixes).\n- i2c: i801: Add support for Intel Arrow Lake-H (stable-fixes).\n- i2c: i801: Add support for Intel Panther Lake (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix 'ghost' detections (git-fixes).\n- i2c: mux: demux-pinctrl: check initial mux selection, too (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: rcar: fix NACK handling when being a target (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (stable-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() (git-fixes).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: adc: ad7124: Disable all channels at probe time (git-fixes).\n- iio: adc: at91: call input_free_device() on allocated iio_dev (git-fixes).\n- iio: adc: rockchip_saradc: fix information leak in triggered buffer (git-fixes).\n- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() (git-fixes).\n- iio: adc: ti-ads8688: fix information leak in triggered buffer (git-fixes).\n- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (git-fixes).\n- iio: gyro: fxas21002c: Fix missing data update in trigger handler (git-fixes).\n- iio: imu: kmx61: fix information leak in triggered buffer (git-fixes).\n- iio: inkern: call iio_device_put() only on mapped devices (git-fixes).\n- iio: light: vcnl4035: fix information leak in triggered buffer (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- iio: pressure: zpa2326: fix information leak in triggered buffer (git-fixes).\n- iio: test : check null return of kunit_kmalloc in iio_rescale_test_scale (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- irqchip/gic-v3: Force propagation of the active state with a read-back (stable-fixes).\n- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base (stable-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kABI: Fix kABI after TDX KVM backports (jsc#PED-6143).\n- kABI: Restore exported __arm_smccc_sve_check (git-fixes)\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- lib/stackdepot: print disabled message only if truly disabled (git-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- mailbox: pcc: Add support for platform notification handling (stable-fixes).\n- mailbox: pcc: Support shared interrupt for multiple subspaces (stable-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4035 (stable-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- memory tiering: count PGPROMOTE_SUCCESS when mem tiering is enabled (git-fixes).\n- memory-failure: use a folio in me_huge_page() (git-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling (git-fixes).\n- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm,page_owner: do not remove __GFP_NOLOCKDEP in add_stack_record_to_list (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/memory-failure: cast index to loff_t before shifting it (git-fixes).\n- mm/memory-failure: check the mapcount of the precise page (git-fixes).\n- mm/memory-failure: fix crash in split_huge_page_to_list from soft_offline_page (git-fixes).\n- mm/memory-failure: pass the folio and the page to collect_procs() (git-fixes).\n- mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu (git-fixes).\n- mm/memory_hotplug: add missing mem_hotplug_lock (git-fixes).\n- mm/memory_hotplug: fix error handling in add_memory_resource() (git-fixes).\n- mm/memory_hotplug: prevent accessing by index=-1 (git-fixes).\n- mm/memory_hotplug: use pfn math in place of direct struct page manipulation (git-fixes).\n- mm/migrate: correct nr_failed in migrate_pages_sync() (git-fixes).\n- mm/migrate: fix deadlock in migrate_pages_batch() on large folios (git-fixes).\n- mm/migrate: putback split folios when numa hint migration fails (git-fixes).\n- mm/migrate: split source folio if it is on deferred split list (git-fixes).\n- mm/page_owner: remove free_ts from page_owner output (git-fixes).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mm: convert DAX lock/unlock page to lock/unlock folio (git-fixes).\n- mm: memory-failure: ensure moving HWPoison flag to the raw error pages (git-fixes).\n- mm: memory-failure: fetch compound head after extra page refcnt is held (git-fixes).\n- mm: memory-failure: fix potential page refcnt leak in memory_failure() (git-fixes).\n- mm: memory-failure: fix race window when trying to get hugetlb folio (git-fixes).\n- mm: memory-failure: remove unneeded PageHuge() check (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: core: Further prevent card detect during shutdown (git-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- modpost: fix the missed iteration for the max bit in do_input() (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting 'num_images' to work (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- net: usb: qmi_wwan: add Telit FE910C04 compositions (stable-fixes).\n- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() (git-fixes).\n- net: wwan: t7xx: Fix FSM command timeout issue (git-fixes).\n- netdevsim: copy addresses for both in and out paths (git-fixes).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it (git-fixes).\n- platform/x86/intel-uncore-freq: Ignore minor version change (bsc#1225897).\n- platform/x86/intel/tpmi: Add defines to get version information (bsc#1225897).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0 (bsc#1215199).\n- powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() (bsc#1215199).\n- powerpc/fadump: Refactor and prepare fadump_cma_init for late init (bsc#1215199).\n- powerpc/iommu: Move pSeries specific functions to pseries/iommu.c (bsc#1220711 ltc#205755).\n- powerpc/iommu: Only build sPAPR access functions on pSeries (bsc#1220711 ltc#205755).\n- powerpc/kexec: Fix return of uninitialized variable (bsc#1194869).\n- powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869).\n- powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869).\n- powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869).\n- powerpc/powernv/pci: Remove MVE code (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove ioda1 support (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove last IODA1 defines (bsc#1220711 ltc#205755).\n- powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869).\n- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).\n- powerpc/pseries/vas: Add close() callback in vas_vm_ops struct (bsc#1234825).\n- powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869).\n- powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869).\n- powerpc/pseries: Use correct data types from pseries_hp_errorlog struct (bsc#1215199).\n- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regmap: detach regmap from dev on regmap_exit (git-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- s390x config: IOMMU_DEFAULT_DMA_LAZY=y (bsc#1235646)\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- selftests: mptcp: avoid spurious errors on disconnect (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- sound: usb: enable DSD output for ddHiFi TC44C (stable-fixes).\n- sound: usb: format: do not warn that raw DSD is unsupported (stable-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- spi: mpc52xx: Add cancel_work_sync before module remove (git-fixes).\n- stackdepot: rename pool_index to pool_index_plus_1 (git-fixes).\n- stackdepot: respect __GFP_NOLOCKDEP allocation flag (git-fixes).\n- staging: iio: ad9832: Correct phase range check (git-fixes).\n- staging: iio: ad9834: Correct phase range check (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- tdx: following fixup for mapping_level porting conflict (jsc#PED-6143).\n- tdx: init has_private_mem during tdx init (jsc#PED-6143).\n- the end of (the first phase of) TDX KVM patch series (jsc#PED-6143).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- thermal: of: fix OF node leak in of_thermal_zone_find() (git-fixes).\n- thunderbolt: Add support for Intel Lunar Lake (stable-fixes).\n- thunderbolt: Add support for Intel Panther Lake-M/P (stable-fixes).\n- tipc: fix NULL deref in cleanup_bearer() (bsc#1235433).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm: Map the ACPI provided event log (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: 8250: Fix another runtime PM usage counter underflow (git-fixes).\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- usb-storage: Add max sectors quirk for Nokia 208 (stable-fixes).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3-am62: Disable autosuspend during remove (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: gadget: fix writing NYET threshold (git-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: fix reference leak in usb_new_device() (git-fixes).\n- usb: gadget: configfs: Ignore trailing LF for user strings to cdev (git-fixes).\n- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (git-fixes).\n- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints (git-fixes).\n- usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- vmscan,migrate: fix page count imbalance on node stats when demoting pages (git-fixes).\n- watchdog: apple: Actually flush writes after requesting watchdog restart (git-fixes).\n- watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes).\n- watchdog: rti: of: honor timeout-sec property (git-fixes).\n- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler (stable-fixes).\n- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset (stable-fixes).\n- watchdog: rzg2l_wdt: Remove reset de-assert from probe (stable-fixes).\n- wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() (stable-fixes).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: Add non-atomic station iterator (stable-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: export ieee80211_purge_tx_queue() for drivers (stable-fixes).\n- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: mac80211: wake the queues in case of failure in resume (stable-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- x86/kexec: Reset TDX private memory on platforms with TDX erratum (jsc#PED-6143).\n- x86/kexec: do unconditional WBINVD for bare-metal in relocate_kernel() (jsc#PED-6143).\n- x86/kexec: do unconditional WBINVD for bare-metal in stop_this_cpu() (jsc#PED-6143).\n- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0 (git-fixes).\n- x86/virt/tdx: Add TDX memory reset notifier to reset other private pages (jsc#PED-6143).\n- x86/virt/tdx: Exclude memory region hole within CMR as TDMR's reserved area (jsc#PED-6143).\n- x86/virt/tdx: Explicitly save/restore RBP for seamcall_saved_ret() (jsc#PED-6143).\n- x86/virt/tdx: Get information about TDX module and TDX-capable memory (jsc#PED-6143).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-01-29T16:11:29Z","modified":"2026-02-04T02:27:31.070473Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20165-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).\n- CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).\n- CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).\n- CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).\n- CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).\n- CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).\n- CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized\n  delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).\n- CVE-2024-53170: block: fix uaf for flush rq while iterating tags (bsc#1234888).\n- CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).\n- CVE-2024-53175: ipc: fix memleak if msg_init_ns failed in create_ipc_ns (bsc#1234893).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey() (bsc#1234901).\n- CVE-2024-53187: io_uring: check for overflows in io_pin_pages (bsc#1234947).\n- CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use (bsc#1234957).\n- CVE-2024-53196: KVM: arm64: Do not retire aborted MMIO instruction (bsc#1234906).\n- CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).\n- CVE-2024-53203: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit() (bsc#1235011).\n- CVE-2024-53232: iommu/s390: Implement blocking domain (bsc#1235050).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53236: xsk: Free skb when TX metadata options are invalid (bsc#1235000).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-53685: ceph: give up on paths longer than PATH_MAX (bsc#1235720).\n- CVE-2024-55639: net: renesas: rswitch: avoid use-after-put for a device tree node (bsc#1235737).\n- CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit() (bsc#1235745).\n- CVE-2024-56372: net: tun: fix tun_napi_alloc_frags() (bsc#1235753).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).\n- CVE-2024-56569: ftrace: Fix regression with module command in stack_trace_filter (bsc#1235031).\n- CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization (bsc#1235123).\n- CVE-2024-56589: scsi: hisi_sas: Add cond_resched() for no forced preemption model (bsc#1235241).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).\n- CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).\n- CVE-2024-56602: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (bsc#1235521).\n- CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create() (bsc#1235415).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56608: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487).\n- CVE-2024-56610: kcsan: Turn report_filterlist_lock into a raw_spinlock (bsc#1235390).\n- CVE-2024-56611: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (bsc#1235391).\n- CVE-2024-56614: xsk: fix OOB map writes when deleting elements (bsc#1235424).\n- CVE-2024-56615: bpf: fix OOB devmap writes when deleting elements (bsc#1235426).\n- CVE-2024-56617: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU (bsc#1235429).\n- CVE-2024-56620: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled (bsc#1235227).\n- CVE-2024-56622: scsi: ufs: core: sysfs: Prevent div by zero (bsc#1235251).\n- CVE-2024-56631: scsi: sg: Fix slab-use-after-free read in sg_release() (bsc#1235480).\n- CVE-2024-56635: net: avoid potential UAF in default_operstate() (bsc#1235519).\n- CVE-2024-56636: geneve: do not assume mac header is set in geneve_xmit_skb() (bsc#1235520).\n- CVE-2024-56637: netfilter: ipset: Hold module reference while requesting a module (bsc#1235523).\n- CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).\n- CVE-2024-56643: dccp: Fix memory leak in dccp_feat_change_recv (bsc#1235132).\n- CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fill_frame_info() (bsc#1235451).\n- CVE-2024-56649: net: enetc: Do not configure preemptible TCs if SIs do not support (bsc#1235449).\n- CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430).\n- CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips (bsc#1235444).\n- CVE-2024-56659: net: lapb: increase LAPB_HEADER_LEN (bsc#1235439).\n- CVE-2024-56660: net/mlx5: DR, prevent potential error pointer dereference (bsc#1235437).\n- CVE-2024-56664: bpf, sockmap: Fix race between element replace and close() (bsc#1235249).\n- CVE-2024-56665: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog (bsc#1235489).\n- CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (bsc#1235555).\n- CVE-2024-56679: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (bsc#1235498).\n- CVE-2024-56693: brd: defer automatic disk creation until module initialization succeeds (bsc#1235418).\n- CVE-2024-56694: bpf: fix recursive lock when verdict program return SK_PASS (bsc#1235412).\n- CVE-2024-56704: 9p/xen: fix release of IRQ (bsc#1235584).\n- CVE-2024-56707: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (bsc#1235545).\n- CVE-2024-56708: EDAC/igen6: Avoid segmentation fault on module unload (bsc#1235564).\n- CVE-2024-56712: udmabuf: fix memory leak on last export_udmabuf() error path (bsc#1235565).\n- CVE-2024-56715: ionic: Fix netdev notifier unregister on failure (bsc#1235612).\n- CVE-2024-56716: netdevsim: prevent bad user input in nsim_dev_health_break_write() (bsc#1235587).\n- CVE-2024-56725: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c (bsc#1235578).\n- CVE-2024-56726: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c (bsc#1235582).\n- CVE-2024-56727: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (bsc#1235583).\n- CVE-2024-56728: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (bsc#1235656).\n- CVE-2024-56729: smb: Initialize cfid-\u003etcon before performing network ops (bsc#1235503).\n- CVE-2024-56747: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (bsc#1234934).\n- CVE-2024-56748: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (bsc#1235627).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n- CVE-2024-56759: btrfs: fix use-after-free when COWing tree bock and tracing is enabled (bsc#1235645).\n- CVE-2024-56763: tracing: Prevent bad count for tracing_cpumask_write (bsc#1235638).\n- CVE-2024-56774: btrfs: add a sanity check for btrfs root in btrfs_search_slot() (bsc#1235653).\n- CVE-2024-56775: drm/amd/display: Fix handling of plane refcount (bsc#1235657).\n- CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data (bsc#1235759).\n- CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235768).\n- CVE-2024-57795: RDMA/rxe: Remove the direct link to net_device (bsc#1235906).\n- CVE-2024-57801: net/mlx5e: Skip restore TC rules for vport rep without loaded flag (bsc#1235940).\n- CVE-2024-57802: netrom: check buffer length before accessing it (bsc#1235941).\n- CVE-2024-57804: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (bsc#1235779).\n- CVE-2024-57809: PCI: imx6: Fix suspend/resume support on i.MX6QDL (bsc#1235793).\n- CVE-2024-57838: s390/entry: Mark IRQ entries to fix stack depot warnings (bsc#1235798).\n- CVE-2024-57857: RDMA/siw: Remove direct link to net_device (bsc#1235946).\n- CVE-2024-57884: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (bsc#1235948).\n- CVE-2024-57892: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (bsc#1235964).\n- CVE-2024-57896: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (bsc#1235965).\n- CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets (bsc#1235967).\n- CVE-2024-57917: topology: Keep the cpumask unchanged when printing cpumap (bsc#1236127).\n- CVE-2024-57929: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (bsc#1236096).\n- CVE-2024-57931: selinux: ignore unknown extended permissions (bsc#1236192).\n- CVE-2024-57932: gve: guard XDP xmit NDO on existence of xdp queues (bsc#1236190).\n- CVE-2024-57933: gve: guard XSK operations on the existence of queues (bsc#1236178).\n- CVE-2024-57938: net/sctp: Prevent autoclose integer overflow in sctp_association_init() (bsc#1236182).\n- CVE-2024-57946: virtio-blk: do not keep queue frozen during system suspend (bsc#1236247).\n- CVE-2025-21632: x86/fpu: Ensure shadow stack is active before \"getting\" registers (bsc#1236106).\n- CVE-2025-21649: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (bsc#1236143).\n- CVE-2025-21650: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue (bsc#1236144).\n- CVE-2025-21651: net: hns3: do not auto enable misc vector (bsc#1236145).\n- CVE-2025-21652: ipvlan: Fix use-after-free in ipvlan_get_iflink() (bsc#1236160).\n- CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (bsc#1236161).\n- CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (bsc#1236163).\n- CVE-2025-21662: net/mlx5: Fix variable not being completed when function returns (bsc#1236198).\n- CVE-2025-21663: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (bsc#1236260).\n- CVE-2025-21664: dm thin: make get_first_thin use rcu-safe list first function (bsc#1236262).\n- CVE-2025-21674: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (bsc#1236688).\n- CVE-2025-21676: net: fec: handle page_pool_dev_alloc_pages error (bsc#1236696).\n- CVE-2025-21682: eth: bnxt: always recalculate features after XDP clearing, fix null-deref (bsc#1236703).\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A (stable-fixes).\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 (stable-fixes).\n- ACPI: PCC: Add PCC shared memory region command and status bitfields (stable-fixes).\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: fan: cleanup resources in the error path of .probe() (git-fixes).\n- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] (stable-fixes).\n- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] (stable-fixes).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: resource: acpi_dev_irq_override(): Check DMI match last (stable-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio (stable-fixes).\n- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop (git-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model (stable-fixes).\n- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA (stable-fixes).\n- ALSA: hda/realtek: Add support for Galaxy Book2 Pro (NP950XEE) (stable-fixes).\n- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx (stable-fixes).\n- ALSA: hda/realtek: Enable headset mic on Positivo C6400 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (bsc#1235686).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Fix headset detection failure due to unstable sort (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for USB Audio Device (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ASoC: Intel: avs: Fix theoretical infinite loop (git-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: acp: Support microphone from Lenovo Go S (stable-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: mediatek: disable buffer pre-allocation (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback (git-fixes).\n- ASoC: rt722: add delay time to wait for the calibration procedure (stable-fixes).\n- ASoC: samsung: Add missing depends on I2C (git-fixes).\n- ASoC: samsung: Add missing selects for MFD_WM8994 (stable-fixes).\n- ASoC: sun4i-spdif: Add clock multiplier settings (git-fixes).\n- ASoC: wm8994: Add depends on MFD core (stable-fixes).\n- Bluetooth: Add support ITTIM PE50-M75C (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection (git-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (git-fixes).\n- Bluetooth: MGMT: Fix Add Device to responding before completing (git-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btnxpuart: Fix driver sending truncated data (git-fixes).\n- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming (git-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 (stable-fixes).\n- Bluetooth: btusb: add callback function in btusb suspend/resume (stable-fixes).\n- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: hci_sync: Fix not setting Random Address when required (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Delete XHCI patch for regression (bsc#1235550)\n- Disable ceph (jsc#PED-7242)\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- Drop downstream TPM fix patch (bsc#1233260 bsc#1233259 bsc#1232421)\n- Drop uvcvideo fix due to regression (bsc#1235894)\n- EDAC/{i10nm,skx,skx_common}: Support UV systems (bsc#1234693).\n- HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (git-fixes).\n- HID: fix generic desktop D-Pad controls (git-fixes).\n- HID: hid-sensor-hub: do not use stale platform-data on remove (git-fixes).\n- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- HID: multitouch: fix support for Goodix PID 0x01e9 (git-fixes).\n- Input: atkbd - map F23 key to support default copilot shortcut (stable-fixes).\n- Input: bbnsm_pwrkey - add remove hook (git-fixes).\n- Input: bbnsm_pwrkey - fix missed key press after suspend (git-fixes).\n- Input: davinci-keyscan - remove leftover header (git-fixes).\n- Input: xpad - add QH Electronics VID/PID (stable-fixes).\n- Input: xpad - add support for Nacon Evol-X Xbox One Controller (stable-fixes).\n- Input: xpad - add support for Nacon Pro Compact (stable-fixes).\n- Input: xpad - add support for wooting two he (arm) (stable-fixes).\n- Input: xpad - add unofficial Xbox 360 wireless receiver clone (stable-fixes).\n- Input: xpad - improve name of 8BitDo controller 2dc8:3106 (stable-fixes).\n- KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits (bsc#1234635).\n- KVM: s390: Reject KVM_SET_GSI_ROUTING on ucontrol VMs (git-fixes bsc#1235776).\n- KVM: s390: Reject setting flic pfault attributes on ucontrol VMs (git-fixes bsc#1235777).\n- KVM: s390: vsie: fix virtual/physical address in unpin_scb() (git-fixes bsc#1235778).\n- NFC: nci: Add bounds checking in nci_hci_create_pipe() (git-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation (git-fixes).\n- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq (git-fixes).\n- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (git-fixes).\n- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() (git-fixes).\n- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() (git-fixes).\n- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() (git-fixes).\n- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test (git-fixes).\n- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error (git-fixes).\n- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset() (git-fixes).\n- PCI: imx6: Skip controller_id generation logic for i.MX7D (git-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: microchip: Set inbound address translation for coherent or non-coherent mode (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() (git-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- PM: hibernate: Add error handling for syscore_suspend() (git-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Add send queue size check for variable wqe (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix MSN table size for variable wqe mode (git-fixes)\n- RDMA/bnxt_re: Fix max SGEs for the Work Request (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Fix the max WQE size for static WQE support (git-fixes)\n- RDMA/bnxt_re: Fix the max WQEs used in Static WQE mode (git-fixes)\n- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error (git-fixes)\n- RDMA/bnxt_re: Fix to export port num to ib_query_qp (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx4: Avoid false error about access to uninitialized gids array (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (git-fixes)\n- RDMA/mlx5: Fix implicit ODP use after free (git-fixes)\n- RDMA/mlx5: Fix indirect mkey ODP page count (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/rxe: Fix mismatched max_msg_sz (git-fixes)\n- RDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\" (git-fixes)\n- RDMA/srp: Fix error handling in srp_add_port (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- Revert \"HID: multitouch: Add support for lenovo Y9000P Touchpad\" (stable-fixes).\n- Revert \"block/mq-deadline: use correct way to throttling write requests\" (bsc#1234146).\n- Revert \"btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\"\n- Revert \"drm/i915/dpt: Make DPT object unshrinkable\" (stable-fixes).\n- Revert \"igb: Disable threaded IRQ for igb_msix_other\" (git-fixes).\n- Revert \"mm, kmsan: fix infinite recursion due to RCU critical section\" (bsc#1230413)\n- Revert \"mm/sparsemem: fix race in accessing memory_section-\u003eusage\" (bsc#1230413)\n- Revert \"mm: prevent derefencing NULL ptr in pfn_section_valid()\" (bsc#1230413)\n- Revert \"mtd: spi-nor: core: replace dummy buswidth from addr to data\" (git-fixes).\n- Revert \"unicode: Do not special case ignorable code points\" (stable-fixes).\n- Revert \"usb: gadget: u_serial: Disable ep before setting port to null\n  to fix the crash caused by port being null\" (stable-fixes).\n- Revert 'arm64: Kconfig: Make SME depend on BROKEN for now' \n- Revert 0dd78566990 (\"Disable ceph (jsc#PED-7242)\") \n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: core: Disable LPM only for non-suspended ports (git-fixes).\n- USB: serial: cp210x: add Phoenix Contact UPS Device (stable-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM815 (stable-fixes).\n- USB: serial: option: add Neoway N723-EA support (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (git-fixes).\n- USB: usblp: return error when setting unsupported protocol (git-fixes).\n- VFS: use system_unbound_wq for delayed_mntput (bsc#1234683).\n- VMCI: fix reference to ioctl-number.rst (git-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY (git-fixes).\n- afs: Fix cleanup of immediately failed async calls (git-fixes).\n- afs: Fix directory format encoding struct (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call (git-fixes).\n- afs: Fix the maximum cell name length (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() (git-fixes)\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented (git-fixes)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes bsc#1236245)\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- arm64: dts: rockchip: Add sdmmc/sdio/emmc reset controls for RK3328 (git-fixes)\n- arm64: dts: rockchip: add hevc power domain clock to rk3328 (git-fixes).\n- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma (git-fixes)\n- arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL (git-fixes).\n- arm64: tegra: Disable Tegra234 sce-fabric node (git-fixes)\n- arm64: tegra: Fix Tegra234 PCIe interrupt-map (git-fixes)\n- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible (git-fixes)\n- ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() (stable-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of \"cgroup_mutex or RCU read lock required!\" (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (git-fixes)\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235445).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235445).\n- bus: mhi: host: Free mhi_buf vector inside mhi_alloc_bhie_table() (git-fixes).\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- ceph: improve error handling and short/overflow-read logic in __ceph_sync_read() (bsc#1228592).\n- checkpatch: always parse orig_commit in fixes tag (git-fixes).\n- checkpatch: check for missing Fixes tags (stable-fixes).\n- cleanup: Add conditional guard support (stable-fixes).\n- cleanup: Adjust scoped_guard() macros to avoid potential warning (stable-fixes).\n- cleanup: Remove address space of returned pointer (git-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- cpufreq: ACPI: Fix max-frequency computation (git-fixes).\n- cpufreq: Do not unregister cpufreq cooling on CPU hotplug (git-fixes).\n- cpufreq: amd-pstate: remove global header file (git-fixes).\n- cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization (bsc#1234619).\n- cpufreq: intel_pstate: Drop redundant locking from intel_pstate_driver_cleanup() (bsc#1234619).\n- cpufreq: intel_pstate: Fix unchecked HWP MSR access (bsc#1234619).\n- cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller (bsc#1234619).\n- cpufreq: intel_pstate: Get rid of unnecessary READ_ONCE() annotations (bsc#1234619).\n- cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock (git-fixes).\n- cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE() (bsc#1234619).\n- cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Refine computation of P-state for given frequency (bsc#1234619).\n- cpufreq: intel_pstate: Replace three global.turbo_disabled checks (bsc#1234619).\n- cpufreq: intel_pstate: Revise global turbo disable check (bsc#1234619).\n- cpufreq: intel_pstate: Simplify spinlock locking (bsc#1234619).\n- cpufreq: intel_pstate: Update the maximum CPU frequency consistently (bsc#1234619).\n- cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing (git-fixes).\n- cpufreq: intel_pstate: Use __ro_after_init for three variables (bsc#1234619).\n- cpufreq: intel_pstate: Wait for canceled delayed work to complete (bsc#1234619).\n- cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back (git-fixes).\n- cpuidle: Avoid potential overflow in integer multiplication (git-fixes).\n- cpupower: fix TSC MHz calculation (git-fixes).\n- crypto: caam - use JobR's space to access page 0 regs (git-fixes).\n- crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes (git-fixes).\n- crypto: ecdsa - Avoid signed integer overflow on signature decoding (stable-fixes).\n- crypto: ecdsa - Convert byte arrays with key coordinates to digits (stable-fixes).\n- crypto: ecdsa - Rename keylen to bufsize where necessary (stable-fixes).\n- crypto: ecdsa - Use ecc_digits_from_bytes to convert signature (stable-fixes).\n- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async' (git-fixes).\n- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: qce - fix goto jump in error path (git-fixes).\n- crypto: qce - fix priority to be less than ARMv8 CE (git-fixes).\n- crypto: qce - unregister previously registered algos in error path (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devcoredump: cleanup some comments (git-fixes).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dlm: fix possible lkb_resource null dereference (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- dmaengine: ti: edma: fix OF node reference leaks in edma_driver (git-fixes).\n- docs: media: update location of the media patches (stable-fixes).\n- docs: power: Fix footnote reference for Toshiba Satellite P10-554 (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() (git-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers/card_reader/rtsx_usb: Restore interrupt based detection (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Add check for granularity in dml ceil/floor helpers (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix DSC-re-computing (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Fix incorrect DSC recompute trigger (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use HW lock mgr for PSR1 (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/display: increase MAX_SURFACES to the value supported by hw (stable-fixes).\n- drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config() (git-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared under SRIOV (git-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table (git-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: always sync the GFX pipe on ctx switch (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: simplify return statement in amdgpu_ras_eeprom_init (git-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini() (git-fixes).\n- drm/amdkfd: Correct the migration DMA map direction (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: fixed page fault when enable MES shader debugger (git-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: Fix page property being used for non writecombine buffers (git-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915/fb: Relax clear color alignment to 64 bytes (stable-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/mediatek: Add return value check when reading DPCD (git-fixes).\n- drm/mediatek: Add support for 180-degree rotation in the display driver (git-fixes).\n- drm/mediatek: Fix YCbCr422 color format issue for DP (git-fixes).\n- drm/mediatek: Fix mode valid issue for dp (git-fixes).\n- drm/mediatek: Set private-\u003eall_drm_private[i]-\u003edrm to NULL if mtk_drm_bind returns err (git-fixes).\n- drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188 (git-fixes).\n- drm/mediatek: stop selecting foreign drivers (git-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/msm/dp: set safe_to_exit_level before printing it (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550 (git-fixes).\n- drm/msm: Check return value of of_dma_configure() (git-fixes).\n- drm/msm: do not clean up priv-\u003ekms prematurely (git-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/rcar-du: dsi: Fix PHY lock bit check (git-fixes).\n- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() (git-fixes).\n- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8 (git-fixes).\n- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset (git-fixes).\n- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0 (git-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/tidss: Clear the interrupt status for interrupts being disabled (git-fixes).\n- drm/tidss: Fix issue in irq handling causing irq-flood issue (git-fixes).\n- drm/v3d: Assign job pointer to NULL before signaling the fence (git-fixes).\n- drm/v3d: Ensure job pointer is set to NULL after job completion (git-fixes).\n- drm/v3d: Stop active perfmon if it is being destroyed (git-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm/vmwgfx: Add new keep_resv BO param (git-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: ensure that ctime is updated whenever the mtime is (git-fixes).\n- exfat: fix the infinite loop in __exfat_free_cluster() (git-fixes).\n- exfat: fix the infinite loop in exfat_readdir() (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() (git-fixes).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- genirq: Make handle_enforce_irqctx() unconditionally available (git-fixes).\n- genksyms: fix memory leak when the same symbol is added from source (git-fixes).\n- genksyms: fix memory leak when the same symbol is read from *.symref file (git-fixes).\n- gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- gpio: mxc: remove dead code after switch to DT-only (git-fixes).\n- gpio: xilinx: Convert gpio_lock to raw spinlock (git-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur (git-fixes).\n- hwmon: (drivetemp) Set scsi command timeout to 10s (stable-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use \"proxy\" headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix division of negative numbers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- hyperv: Do not overlap the hvcall IO areas in get_vtl() (git-fixes).\n- i2c: core: fix reference leak in i2c_register_adapter() (git-fixes).\n- i2c: i801: Add support for Intel Arrow Lake-H (stable-fixes).\n- i2c: i801: Add support for Intel Panther Lake (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix \"ghost\" detections (git-fixes).\n- i2c: mux: demux-pinctrl: check initial mux selection, too (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: rcar: fix NACK handling when being a target (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (stable-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ibmvnic: Free any outstanding tx skbs during scrq reset (bsc#1226980).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() (git-fixes).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: adc: ad7124: Disable all channels at probe time (git-fixes).\n- iio: adc: ad_sigma_delta: Handle CS assertion as intended in ad_sd_read_reg_raw() (git-fixes).\n- iio: adc: at91: call input_free_device() on allocated iio_dev (git-fixes).\n- iio: adc: rockchip_saradc: fix information leak in triggered buffer (git-fixes).\n- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() (git-fixes).\n- iio: adc: ti-ads8688: fix information leak in triggered buffer (git-fixes).\n- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (git-fixes).\n- iio: gyro: fxas21002c: Fix missing data update in trigger handler (git-fixes).\n- iio: iio-mux: kzalloc instead of devm_kzalloc to ensure page alignment (git-fixes).\n- iio: imu: kmx61: fix information leak in triggered buffer (git-fixes).\n- iio: inkern: call iio_device_put() only on mapped devices (git-fixes).\n- iio: light: as73211: fix channel handling in only-color triggered buffer (git-fixes).\n- iio: light: vcnl4035: fix information leak in triggered buffer (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- iio: pressure: zpa2326: fix information leak in triggered buffer (git-fixes).\n- iio: test : check null return of kunit_kmalloc in iio_rescale_test_scale (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- intel_th: core: fix kernel-doc warnings (git-fixes).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- ipmi: ipmb: Add check devm_kasprintf() returned value (git-fixes).\n- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response (git-fixes).\n- irqchip/gic-v3: Force propagation of the active state with a read-back (stable-fixes).\n- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base (stable-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct auto_pin_cfg_item change (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- kheaders: Ignore silly-rename files (stable-fixes).\n- ktest.pl: Avoid false positives with grub2 skip regex (stable-fixes).\n- ktest.pl: Check kernelrelease return in get_version (git-fixes).\n- ktest.pl: Fix typo \"accesing\" (git-fixes).\n- ktest.pl: Fix typo in comment (git-fixes).\n- ktest.pl: Remove unused declarations in run_bisect_test function (git-fixes).\n- ktest: force $buildonly = 1 for 'make_warnings_file' test type (stable-fixes).\n- landlock: Handle weird files (git-fixes).\n- latencytop: use correct kernel-doc format for func params (git-fixes).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- leds: lp8860: Write full EEPROM, not only half of it (git-fixes).\n- leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata() (git-fixes).\n- lib/inflate.c: remove dead code (git-fixes).\n- lib/stackdepot: print disabled message only if truly disabled (git-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- mac802154: check local interfaces before deleting sdata list (stable-fixes).\n- mailbox: pcc: Add support for platform notification handling (stable-fixes).\n- mailbox: pcc: Support shared interrupt for multiple subspaces (stable-fixes).\n- mailbox: tegra-hsp: Clear mailbox before using message (git-fixes).\n- maple_tree: simplify split calculation (git-fixes).\n- media: camif-core: Add check for clk_enable() (git-fixes).\n- media: ccs: Clean up parsed CCS static data on parse failure (git-fixes).\n- media: ccs: Fix CCS static data parsing for large block sizes (git-fixes).\n- media: ccs: Fix cleanup order in ccs_probe() (git-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer (git-fixes).\n- media: i2c: imx412: Add missing newline to prints (git-fixes).\n- media: i2c: ov9282: Correct the exposure offset (git-fixes).\n- media: imx-jpeg: Fix potential error pointer dereference in detach_pm() (git-fixes).\n- media: imx296: Add standby delay during probe (git-fixes).\n- media: lmedm04: Handle errors for lme2510_int_read (git-fixes).\n- media: marvell: Add check for clk_enable() (git-fixes).\n- media: mc: fix endpoint iteration (git-fixes).\n- media: mipi-csis: Add check for clk_enable() (git-fixes).\n- media: nxp: imx8-isi: fix v4l2-compliance test errors (git-fixes).\n- media: ov5640: fix get_light_freq on auto (git-fixes).\n- media: rc: iguanair: handle timeouts (git-fixes).\n- media: rkisp1: Fix unused value issue (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: Fix crash during unbind if gpio unit is in use (git-fixes).\n- media: uvcvideo: Fix double free in error path (git-fixes).\n- media: uvcvideo: Fix event flags in uvc_ctrl_send_events (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4035 (stable-fixes).\n- media: uvcvideo: Only save async fh if success (git-fixes).\n- media: uvcvideo: Propagate buf-\u003eerror to userspace (git-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- media: uvcvideo: Remove dangling pointers (git-fixes).\n- media: uvcvideo: Remove redundant NULL assignment (git-fixes).\n- media: uvcvideo: Support partial control reads (git-fixes).\n- memory tiering: count PGPROMOTE_SUCCESS when mem tiering is enabled (git-fixes).\n- memory-failure: use a folio in me_huge_page() (git-fixes).\n- memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() (git-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- misc: fastrpc: Deregister device nodes properly in error scenarios (git-fixes).\n- misc: fastrpc: Fix copy buffer page size (git-fixes).\n- misc: fastrpc: Fix registered buffer page address (git-fixes).\n- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling (git-fixes).\n- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config (git-fixes).\n- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm,page_owner: do not remove __GFP_NOLOCKDEP in add_stack_record_to_list (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/memory-failure: cast index to loff_t before shifting it (git-fixes).\n- mm/memory-failure: check the mapcount of the precise page (git-fixes).\n- mm/memory-failure: fix crash in split_huge_page_to_list from soft_offline_page (git-fixes).\n- mm/memory-failure: pass the folio and the page to collect_procs() (git-fixes).\n- mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu (git-fixes).\n- mm/memory_hotplug: add missing mem_hotplug_lock (git-fixes).\n- mm/memory_hotplug: fix error handling in add_memory_resource() (git-fixes).\n- mm/memory_hotplug: prevent accessing by index=-1 (git-fixes).\n- mm/memory_hotplug: use pfn math in place of direct struct page manipulation (git-fixes).\n- mm/migrate: correct nr_failed in migrate_pages_sync() (git-fixes).\n- mm/migrate: fix deadlock in migrate_pages_batch() on large folios (git-fixes).\n- mm/migrate: putback split folios when numa hint migration fails (git-fixes).\n- mm/migrate: split source folio if it is on deferred split list (git-fixes).\n- mm/page_owner: remove free_ts from page_owner output (git-fixes).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mm/rodata_test: use READ_ONCE() to read const variable (git-fixes).\n- mm: convert DAX lock/unlock page to lock/unlock folio (git-fixes).\n- mm: memory-failure: ensure moving HWPoison flag to the raw error pages (git-fixes).\n- mm: memory-failure: fetch compound head after extra page refcnt is held (git-fixes).\n- mm: memory-failure: fix potential page refcnt leak in memory_failure() (git-fixes).\n- mm: memory-failure: fix race window when trying to get hugetlb folio (git-fixes).\n- mm: memory-failure: remove unneeded PageHuge() check (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- modpost: fix the missed iteration for the max bit in do_input() (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: onenand: Fix uninitialized retlen in do_otp_read() (git-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- mtd: spinand: Remove write_enable_op() in markbad() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting \"num_images\" to work (git-fixes).\n- net/rose: prevent integer overflows in rose_setsockopt() (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset (git-fixes).\n- net: rose: fix timer races against user threads (git-fixes).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- net: usb: qmi_wwan: add Telit FE910C04 compositions (stable-fixes).\n- net: usb: rtl8150: enable basic endpoint checking (git-fixes).\n- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() (git-fixes).\n- net: wwan: t7xx: Fix FSM command timeout issue (git-fixes).\n- netfilter: nf_tables: validate family when identifying table via handle (bsc#1233778 ZDI-24-1454).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix possible int overflows in nilfs_fiemap() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: Add error check for xa_store in nvme_get_effects_log (git-fixes).\n- nvme: Add error path for xa_store in nvme_init_effects (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix bogus kzalloc() return check in nvme_init_effects_log() (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- nvmet: propagate npwg topology (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- padata: add pd get/put refcnt helper (git-fixes).\n- padata: avoid UAF for reorder_work (git-fixes).\n- padata: fix UAF in padata_reorder (git-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: amd: Take suspend type into consideration which pins are non-wake (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails (git-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it (git-fixes).\n- platform/x86/intel-uncore-freq: Ignore minor version change (bsc#1225897).\n- platform/x86/intel/tpmi: Add defines to get version information (bsc#1225897).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- pm:cpupower: Add missing powercap_set_enabled() stub function (git-fixes).\n- power: ip5xxx_power: Fix return value on ADC read errors (git-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- powerpc/iommu: Move pSeries specific functions to pseries/iommu.c (bsc#1220711 ltc#205755).\n- powerpc/iommu: Only build sPAPR access functions on pSeries (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove MVE code (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove ioda1 support (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove last IODA1 defines (bsc#1220711 ltc#205755).\n- powerpc/pseries/eeh: Fix get PE state translation (bsc#1215199).\n- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).\n- powerpc/pseries/vas: Add close() callback in vas_vm_ops struct (bsc#1234825).\n- pps: add an error check in parport_attach (git-fixes).\n- pps: remove usage of the deprecated ida_simple_xx() API (stable-fixes).\n- printk: Add is_printk_legacy_deferred() (bsc#1236733).\n- printk: Defer legacy printing when holding printk_cpu_sync (bsc#1236733).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- pwm: stm32-lp: Add check for clk_enable() (git-fixes).\n- pwm: stm32: Add check for clk_enable() (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- rcu-tasks: Pull sampling of -\u003epercpu_dequeue_lim out of loop (git-fixes)\n- rcu/tree: Defer setting of jiffies during stall reset (git-fixes)\n- rcu: Dump memory object info if callback function is invalid (git-fixes)\n- rcu: Eliminate rcu_gp_slow_unregister() false positive (git-fixes)\n- rcuscale: Move rcu_scale_writer() (git-fixes)\n- rdma/cxgb4: Prevent potential integer overflow on 32bit (git-fixes)\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: core: Add missing newline character (git-fixes).\n- regulator: of: Implement the unwind path of of_regulator_match() (git-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- remoteproc: core: Fix ida_free call while not allocated (git-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (git-fixes).\n- rtc: zynqmp: Fix optional clock name property (git-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- s390x config: IOMMU_DEFAULT_DMA_LAZY=y (bsc#1235646)\n- samples/landlock: Fix possible NULL dereference in parse_path() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat (bsc#1235865).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat -kabi (bsc#1235865).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (git-fixes).\n- seccomp: Stub for !CONFIG_SECCOMP (stable-fixes).\n- selftest: media_tests: fix trivial UAF typo (git-fixes).\n- selftests/alsa: Fix circular dependency involving global-timer (stable-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- selftests/landlock: Fix error message (git-fixes).\n- selftests/mm/cow: modify the incorrect checking parameters (git-fixes).\n- selftests/powerpc: Fix argument order to timer_sub() (git-fixes).\n- selftests: harness: fix printing of mismatch values in __EXPECT() (git-fixes).\n- selftests: mptcp: avoid spurious errors on disconnect (git-fixes).\n- selftests: tc-testing: reduce rshift value (stable-fixes).\n- selftests: timers: clocksource-switch: Adapt progress to kselftest framework (git-fixes).\n- selinux: Fix SCTP error inconsistency in selinux_socket_bind() (git-fixes).\n- serial: 8250: Adjust the timeout for FIFO mode (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use (git-fixes).\n- serial: sh-sci: Drop __initdata macro for port_cfg (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: atmel: fix device_node release in atmel_soc_device_init() (git-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths (git-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: smem_state: fix missing of_node_put in error path (git-fixes).\n- soc: qcom: socinfo: Avoid out of bounds read of serial number (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- sound: usb: enable DSD output for ddHiFi TC44C (stable-fixes).\n- sound: usb: format: do not warn that raw DSD is unsupported (stable-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- spi: zynq-qspi: Add check for clk_enable() (git-fixes).\n- srcu: Fix srcu_struct node grpmask overflow on 64-bit systems (git-fixes)\n- srcu: Only accelerate on enqueue time (git-fixes)\n- stackdepot: rename pool_index to pool_index_plus_1 (git-fixes).\n- stackdepot: respect __GFP_NOLOCKDEP allocation flag (git-fixes).\n- staging: iio: ad9832: Correct phase range check (git-fixes).\n- staging: iio: ad9834: Correct phase range check (git-fixes).\n- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() (git-fixes).\n- staging: media: max96712: fix kernel oops when removing module (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- supported.conf: Add support for v4l2-dv-timings (jsc#PED-8645)\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- thermal: of: fix OF node leak in of_thermal_zone_find() (git-fixes).\n- thunderbolt: Add support for Intel Lunar Lake (stable-fixes).\n- thunderbolt: Add support for Intel Panther Lake-M/P (stable-fixes).\n- tipc: fix NULL deref in cleanup_bearer() (bsc#1235433).\n- tools: Sync if_xdp.h uapi tooling header (git-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm: Map the ACPI provided event log (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: 8250: Fix another runtime PM usage counter underflow (git-fixes).\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- ubifs: skip dumping tnc tree when zroot is null (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- uio: Fix return value of poll (git-fixes).\n- uio: uio_dmem_genirq: check the return value of devm_kasprintf() (git-fixes).\n- usb-storage: Add max sectors quirk for Nokia 208 (stable-fixes).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3-am62: Disable autosuspend during remove (git-fixes).\n- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk() (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: gadget: fix writing NYET threshold (git-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: fix reference leak in usb_new_device() (git-fixes).\n- usb: gadget: configfs: Ignore trailing LF for user strings to cdev (git-fixes).\n- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (git-fixes).\n- usb: gadget: f_tcm: Decrement command ref count on cleanup (git-fixes).\n- usb: gadget: f_tcm: Do not free command immediately (git-fixes).\n- usb: gadget: f_tcm: Do not prepare BOT write request twice (git-fixes).\n- usb: gadget: f_tcm: Fix Get/SetInterface return value (git-fixes).\n- usb: gadget: f_tcm: Translate error to sense (git-fixes).\n- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint (git-fixes).\n- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints (git-fixes).\n- usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: host: xhci-plat: Assign shared_hcd-\u003ersrc_start (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() (bsc#1235001)\n- usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() (git-fixes).\n- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- usbnet: ipheth: break up NCM header size computation (git-fixes).\n- usbnet: ipheth: check that DPE points past NCM header (git-fixes).\n- usbnet: ipheth: fix DPE OoB read (git-fixes).\n- usbnet: ipheth: fix possible overflow in DPE length check (git-fixes).\n- usbnet: ipheth: refactor NCM datagram loop (git-fixes).\n- usbnet: ipheth: use static NDP16 location in URB (git-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- vmscan,migrate: fix page count imbalance on node stats when demoting pages (git-fixes).\n- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler (stable-fixes).\n- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset (stable-fixes).\n- watchdog: rzg2l_wdt: Remove reset de-assert from probe (stable-fixes).\n- wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855 (git-fixes).\n- wifi: ath11k: cleanup struct ath11k_mon_data (git-fixes).\n- wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() (stable-fixes).\n- wifi: ath12k: fix tx power, max reg power update to firmware (git-fixes).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: brcmfmac: add missing header include for brcmf_dbg (git-fixes).\n- wifi: cfg80211: adjust allocation of colocated AP data (git-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: fw: read STEP table from correct UEFI var (git-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: Add non-atomic station iterator (stable-fixes).\n- wifi: mac80211: Fix common size calculation for ML element (git-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: do not flush non-uploaded STAs (git-fixes).\n- wifi: mac80211: export ieee80211_purge_tx_queue() for drivers (stable-fixes).\n- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: fix tid removal during mesh forwarding (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: mac80211: prohibit deactivating all links (git-fixes).\n- wifi: mac80211: wake the queues in case of failure in resume (stable-fixes).\n- wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO (git-fixes).\n- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC (git-fixes).\n- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 (git-fixes).\n- wifi: mt76: mt7915: firmware restart on devices with a second pcie link (git-fixes).\n- wifi: mt76: mt7915: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7915: fix register mapping (git-fixes).\n- wifi: mt76: mt7921: fix using incorrect group cipher after disconnection (git-fixes).\n- wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (git-fixes).\n- wifi: mt76: mt7996: add max mpdu len capability (git-fixes).\n- wifi: mt76: mt7996: fix HE Phy capability (git-fixes).\n- wifi: mt76: mt7996: fix definition of tx descriptor (git-fixes).\n- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event (git-fixes).\n- wifi: mt76: mt7996: fix ldpc setting (git-fixes).\n- wifi: mt76: mt7996: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7996: fix register mapping (git-fixes).\n- wifi: mt76: mt7996: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtlwifi: destroy workqueue at rtl_deinit_core (git-fixes).\n- wifi: rtlwifi: do not complete firmware loading needlessly (git-fixes).\n- wifi: rtlwifi: fix init_sw_vars leak when probe fails (git-fixes).\n- wifi: rtlwifi: fix memory leaks and invalid access at probe error path (git-fixes).\n- wifi: rtlwifi: pci: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtlwifi: remove unused check_buddy_priv (git-fixes).\n- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix media status report (git-fixes).\n- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop (git-fixes).\n- wifi: rtlwifi: usb: fix workqueue leak when probe fails (git-fixes).\n- wifi: rtlwifi: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- wifi: rtw89: mcc: consider time limits not divisible by 1024 (git-fixes).\n- wifi: wcn36xx: fix channel survey memory allocation size (git-fixes).\n- wifi: wlcore: fix unbalanced pm_runtime calls (git-fixes).\n- workqueue: Add rcu lock check at the end of work item execution (bsc#1236732).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0 (git-fixes).\n- xfs: Add error handling for xfs_reflink_cancel_cow_range (git-fixes).\n- xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-03-27T15:23:42Z","modified":"2026-03-23T04:50:43.221938Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20166-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).\n- CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).\n- CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).\n- CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).\n- CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).\n- CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).\n- CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).\n- CVE-2024-53170: block: fix uaf for flush rq while iterating tags (bsc#1234888).\n- CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).\n- CVE-2024-53175: ipc: fix memleak if msg_init_ns failed in create_ipc_ns (bsc#1234893).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey() (bsc#1234901).\n- CVE-2024-53187: io_uring: check for overflows in io_pin_pages (bsc#1234947).\n- CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use (bsc#1234957).\n- CVE-2024-53196: KVM: arm64: Do not retire aborted MMIO instruction (bsc#1234906).\n- CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).\n- CVE-2024-53203: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit() (bsc#1235011).\n- CVE-2024-53232: iommu/s390: Implement blocking domain (bsc#1235050).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53236: xsk: Free skb when TX metadata options are invalid (bsc#1235000).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-53685: ceph: give up on paths longer than PATH_MAX (bsc#1235720).\n- CVE-2024-55639: net: renesas: rswitch: avoid use-after-put for a device tree node (bsc#1235737).\n- CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit() (bsc#1235745).\n- CVE-2024-56372: net: tun: fix tun_napi_alloc_frags() (bsc#1235753).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).\n- CVE-2024-56569: ftrace: Fix regression with module command in stack_trace_filter (bsc#1235031).\n- CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization (bsc#1235123).\n- CVE-2024-56589: scsi: hisi_sas: Add cond_resched() for no forced preemption model (bsc#1235241).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).\n- CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).\n- CVE-2024-56602: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (bsc#1235521).\n- CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create() (bsc#1235415).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56608: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487).\n- CVE-2024-56610: kcsan: Turn report_filterlist_lock into a raw_spinlock (bsc#1235390).\n- CVE-2024-56611: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (bsc#1235391).\n- CVE-2024-56614: xsk: fix OOB map writes when deleting elements (bsc#1235424).\n- CVE-2024-56615: bpf: fix OOB devmap writes when deleting elements (bsc#1235426).\n- CVE-2024-56617: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU (bsc#1235429).\n- CVE-2024-56620: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled (bsc#1235227).\n- CVE-2024-56622: scsi: ufs: core: sysfs: Prevent div by zero (bsc#1235251).\n- CVE-2024-56631: scsi: sg: Fix slab-use-after-free read in sg_release() (bsc#1235480).\n- CVE-2024-56635: net: avoid potential UAF in default_operstate() (bsc#1235519).\n- CVE-2024-56636: geneve: do not assume mac header is set in geneve_xmit_skb() (bsc#1235520).\n- CVE-2024-56637: netfilter: ipset: Hold module reference while requesting a module (bsc#1235523).\n- CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).\n- CVE-2024-56643: dccp: Fix memory leak in dccp_feat_change_recv (bsc#1235132).\n- CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fill_frame_info() (bsc#1235451).\n- CVE-2024-56649: net: enetc: Do not configure preemptible TCs if SIs do not support (bsc#1235449).\n- CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430).\n- CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips (bsc#1235444).\n- CVE-2024-56659: net: lapb: increase LAPB_HEADER_LEN (bsc#1235439).\n- CVE-2024-56660: net/mlx5: DR, prevent potential error pointer dereference (bsc#1235437).\n- CVE-2024-56664: bpf, sockmap: Fix race between element replace and close() (bsc#1235249).\n- CVE-2024-56665: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog (bsc#1235489).\n- CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (bsc#1235555).\n- CVE-2024-56679: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (bsc#1235498).\n- CVE-2024-56693: brd: defer automatic disk creation until module initialization succeeds (bsc#1235418).\n- CVE-2024-56694: bpf: fix recursive lock when verdict program return SK_PASS (bsc#1235412).\n- CVE-2024-56704: 9p/xen: fix release of IRQ (bsc#1235584).\n- CVE-2024-56707: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (bsc#1235545).\n- CVE-2024-56708: EDAC/igen6: Avoid segmentation fault on module unload (bsc#1235564).\n- CVE-2024-56712: udmabuf: fix memory leak on last export_udmabuf() error path (bsc#1235565).\n- CVE-2024-56715: ionic: Fix netdev notifier unregister on failure (bsc#1235612).\n- CVE-2024-56716: netdevsim: prevent bad user input in nsim_dev_health_break_write() (bsc#1235587).\n- CVE-2024-56725: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c (bsc#1235578).\n- CVE-2024-56726: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c (bsc#1235582).\n- CVE-2024-56727: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (bsc#1235583).\n- CVE-2024-56728: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (bsc#1235656).\n- CVE-2024-56729: smb: Initialize cfid-\u003etcon before performing network ops (bsc#1235503).\n- CVE-2024-56747: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (bsc#1234934).\n- CVE-2024-56748: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (bsc#1235627).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n- CVE-2024-56759: btrfs: fix use-after-free when COWing tree bock and tracing is enabled (bsc#1235645).\n- CVE-2024-56763: tracing: Prevent bad count for tracing_cpumask_write (bsc#1235638).\n- CVE-2024-56774: btrfs: add a sanity check for btrfs root in btrfs_search_slot() (bsc#1235653).\n- CVE-2024-56775: drm/amd/display: Fix handling of plane refcount (bsc#1235657).\n- CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data (bsc#1235759).\n- CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235768).\n- CVE-2024-57795: RDMA/rxe: Remove the direct link to net_device (bsc#1235906).\n- CVE-2024-57801: net/mlx5e: Skip restore TC rules for vport rep without loaded flag (bsc#1235940).\n- CVE-2024-57802: netrom: check buffer length before accessing it (bsc#1235941).\n- CVE-2024-57804: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (bsc#1235779).\n- CVE-2024-57809: PCI: imx6: Fix suspend/resume support on i.MX6QDL (bsc#1235793).\n- CVE-2024-57838: s390/entry: Mark IRQ entries to fix stack depot warnings (bsc#1235798).\n- CVE-2024-57857: RDMA/siw: Remove direct link to net_device (bsc#1235946).\n- CVE-2024-57884: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (bsc#1235948).\n- CVE-2024-57892: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (bsc#1235964).\n- CVE-2024-57896: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (bsc#1235965).\n- CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets (bsc#1235967).\n- CVE-2024-57917: topology: Keep the cpumask unchanged when printing cpumap (bsc#1236127).\n- CVE-2024-57929: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (bsc#1236096).\n- CVE-2024-57931: selinux: ignore unknown extended permissions (bsc#1236192).\n- CVE-2024-57932: gve: guard XDP xmit NDO on existence of xdp queues (bsc#1236190).\n- CVE-2024-57933: gve: guard XSK operations on the existence of queues (bsc#1236178).\n- CVE-2024-57938: net/sctp: Prevent autoclose integer overflow in sctp_association_init() (bsc#1236182).\n- CVE-2024-57946: virtio-blk: do not keep queue frozen during system suspend (bsc#1236247).\n- CVE-2025-21632: x86/fpu: Ensure shadow stack is active before \"getting\" registers (bsc#1236106).\n- CVE-2025-21649: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (bsc#1236143).\n- CVE-2025-21650: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue (bsc#1236144).\n- CVE-2025-21651: net: hns3: do not auto enable misc vector (bsc#1236145).\n- CVE-2025-21652: ipvlan: Fix use-after-free in ipvlan_get_iflink() (bsc#1236160).\n- CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (bsc#1236161).\n- CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (bsc#1236163).\n- CVE-2025-21662: net/mlx5: Fix variable not being completed when function returns (bsc#1236198).\n- CVE-2025-21663: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (bsc#1236260).\n- CVE-2025-21664: dm thin: make get_first_thin use rcu-safe list first function (bsc#1236262).\n- CVE-2025-21674: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (bsc#1236688).\n- CVE-2025-21676: net: fec: handle page_pool_dev_alloc_pages error (bsc#1236696).\n- CVE-2025-21682: eth: bnxt: always recalculate features after XDP clearing, fix null-deref (bsc#1236703).\n\nFeatures added:\n\n  * - Disable ceph (jsc#PED-7242)\n  * - RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n  * - ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n  * - supported.conf: Add support for v4l2-dv-timings  (jsc#PED-8645)\n\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A (stable-fixes).\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 (stable-fixes).\n- ACPI: PCC: Add PCC shared memory region command and status bitfields (stable-fixes).\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: fan: cleanup resources in the error path of .probe() (git-fixes).\n- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] (stable-fixes).\n- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] (stable-fixes).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: resource: acpi_dev_irq_override(): Check DMI match last (stable-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio (stable-fixes).\n- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop (git-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model (stable-fixes).\n- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA (stable-fixes).\n- ALSA: hda/realtek: Add support for Galaxy Book2 Pro (NP950XEE) (stable-fixes).\n- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx (stable-fixes).\n- ALSA: hda/realtek: Enable headset mic on Positivo C6400 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (bsc#1235686).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Fix headset detection failure due to unstable sort (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for USB Audio Device (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ASoC: Intel: avs: Fix theoretical infinite loop (git-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: acp: Support microphone from Lenovo Go S (stable-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: mediatek: disable buffer pre-allocation (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback (git-fixes).\n- ASoC: rt722: add delay time to wait for the calibration procedure (stable-fixes).\n- ASoC: samsung: Add missing depends on I2C (git-fixes).\n- ASoC: samsung: Add missing selects for MFD_WM8994 (stable-fixes).\n- ASoC: sun4i-spdif: Add clock multiplier settings (git-fixes).\n- ASoC: wm8994: Add depends on MFD core (stable-fixes).\n- Add already cherry-picked ids to AMDGPU patch\n- Align git commit ID abbreviation guidelines and checks (git-fixes).\n- Bluetooth: Add support ITTIM PE50-M75C (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection (git-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (git-fixes).\n- Bluetooth: MGMT: Fix Add Device to responding before completing (git-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btnxpuart: Fix driver sending truncated data (git-fixes).\n- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming (git-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 (stable-fixes).\n- Bluetooth: btusb: add callback function in btusb suspend/resume (stable-fixes).\n- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: hci_sync: Fix not setting Random Address when required (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Delete XHCI patch for regression (bsc#1235550)\n- Disable ceph (jsc#PED-7242)\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- Drop downstream TPM fix patch (bsc#1233260 bsc#1233259 bsc#1232421)\n- Drop uvcvideo fix due to regression (bsc#1235894)\n- EDAC/{i10nm,skx,skx_common}: Support UV systems (bsc#1234693).\n- HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (git-fixes).\n- HID: fix generic desktop D-Pad controls (git-fixes).\n- HID: hid-sensor-hub: do not use stale platform-data on remove (git-fixes).\n- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- HID: multitouch: fix support for Goodix PID 0x01e9 (git-fixes).\n- Input: atkbd - map F23 key to support default copilot shortcut (stable-fixes).\n- Input: bbnsm_pwrkey - add remove hook (git-fixes).\n- Input: bbnsm_pwrkey - fix missed key press after suspend (git-fixes).\n- Input: davinci-keyscan - remove leftover header (git-fixes).\n- Input: xpad - add QH Electronics VID/PID (stable-fixes).\n- Input: xpad - add support for Nacon Evol-X Xbox One Controller (stable-fixes).\n- Input: xpad - add support for Nacon Pro Compact (stable-fixes).\n- Input: xpad - add support for wooting two he (arm) (stable-fixes).\n- Input: xpad - add unofficial Xbox 360 wireless receiver clone (stable-fixes).\n- Input: xpad - improve name of 8BitDo controller 2dc8:3106 (stable-fixes).\n- KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits (bsc#1234635).\n- KVM: s390: Reject KVM_SET_GSI_ROUTING on ucontrol VMs (git-fixes bsc#1235776).\n- KVM: s390: Reject setting flic pfault attributes on ucontrol VMs (git-fixes bsc#1235777).\n- KVM: s390: vsie: fix virtual/physical address in unpin_scb() (git-fixes bsc#1235778).\n- Move kABI workaround patch to correct folder\n- Move upstreamed DRM patch into sorted section\n- Move upstreamed NFS patch into sorted section\n- Move upstreamed TPM patch into sorted section\n- Move upstreamed lpfc patches into sorted section\n- Move upstreamed ppc patch into sorted section\n- Move upstreamed sound patch into sorted section\n- Move upstreamed sound patches into sorted section\n- NFC: nci: Add bounds checking in nci_hci_create_pipe() (git-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation (git-fixes).\n- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq (git-fixes).\n- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (git-fixes).\n- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() (git-fixes).\n- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() (git-fixes).\n- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() (git-fixes).\n- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test (git-fixes).\n- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error (git-fixes).\n- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset() (git-fixes).\n- PCI: imx6: Skip controller_id generation logic for i.MX7D (git-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: microchip: Set inbound address translation for coherent or non-coherent mode (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() (git-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- PM: hibernate: Add error handling for syscore_suspend() (git-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Add send queue size check for variable wqe (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix MSN table size for variable wqe mode (git-fixes)\n- RDMA/bnxt_re: Fix max SGEs for the Work Request (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Fix the max WQE size for static WQE support (git-fixes)\n- RDMA/bnxt_re: Fix the max WQEs used in Static WQE mode (git-fixes)\n- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error (git-fixes)\n- RDMA/bnxt_re: Fix to export port num to ib_query_qp (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx4: Avoid false error about access to uninitialized gids array (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (git-fixes)\n- RDMA/mlx5: Fix implicit ODP use after free (git-fixes)\n- RDMA/mlx5: Fix indirect mkey ODP page count (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/rxe: Fix mismatched max_msg_sz (git-fixes)\n- RDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\" (git-fixes)\n- RDMA/srp: Fix error handling in srp_add_port (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- README.BRANCH: Remove copy of branch name\n- Refresh patches.suse/ALSA-hda-realtek-Add-support-for-Samsung-Galaxy-Book.patch.\n- Refresh patches.suse/cpufreq-intel_pstate-Temporarily-boost-P-state-when-.patch.\n- Revert \"HID: multitouch: Add support for lenovo Y9000P Touchpad\" (stable-fixes).\n- Revert \"block/mq-deadline: use correct way to throttling write requests\" (bsc#1234146).\n- Revert \"btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\"\n- Revert \"drm/i915/dpt: Make DPT object unshrinkable\" (stable-fixes).\n- Revert \"igb: Disable threaded IRQ for igb_msix_other\" (git-fixes).\n- Revert \"mtd: spi-nor: core: replace dummy buswidth from addr to data\" (git-fixes).\n- Revert \"unicode: Do not special case ignorable code points\" (stable-fixes).\n- Revert \"usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null\" (stable-fixes).\n- Revert 'arm64: Kconfig: Make SME depend on BROKEN for now' This reverts commit 2ccfee6be929dd4ea49ef59a7ae686473aae40b6 CONFIG_ARM64_SME is enabled by default so some customers may rely on SME. We need further analysis to evaluate to what extent we are impacted and in case we'll disable SME support later.\n- Revert 0dd78566990 (\"Disable ceph (jsc#PED-7242)\") Apparently, jsc#PED-7242 is only deprecate ceph for 15-SP6 and disable for 15-SP7. Revert the disabling.\n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: core: Disable LPM only for non-suspended ports (git-fixes).\n- USB: serial: cp210x: add Phoenix Contact UPS Device (stable-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM815 (stable-fixes).\n- USB: serial: option: add Neoway N723-EA support (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (git-fixes).\n- USB: usblp: return error when setting unsupported protocol (git-fixes).\n- VFS: use system_unbound_wq for delayed_mntput (bsc#1234683).\n- VMCI: fix reference to ioctl-number.rst (git-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY (git-fixes).\n- afs: Fix cleanup of immediately failed async calls (git-fixes).\n- afs: Fix directory format encoding struct (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call (git-fixes).\n- afs: Fix the maximum cell name length (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() (git-fixes)\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented (git-fixes)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes bsc#1236245) Update arm64 default configuration file\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes).\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- arm64: dts: rockchip: Add sdmmc/sdio/emmc reset controls for RK3328 (git-fixes)\n- arm64: dts: rockchip: add hevc power domain clock to rk3328 (git-fixes).\n- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma (git-fixes)\n- arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL (git-fixes).\n- arm64: tegra: Disable Tegra234 sce-fabric node (git-fixes)\n- arm64: tegra: Fix Tegra234 PCIe interrupt-map (git-fixes)\n- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible (git-fixes)\n- ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() (stable-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blacklist.conf: printk/sysctl: breaks kernel without pre-requisite patches (bsc#1229025)\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of \"cgroup_mutex or RCU read lock required!\" (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (git-fixes)\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235445).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235445).\n- bus: mhi: host: Free mhi_buf vector inside mhi_alloc_bhie_table() (git-fixes).\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- ceph: improve error handling and short/overflow-read logic in __ceph_sync_read() (bsc#1228592).\n- checkpatch: always parse orig_commit in fixes tag (git-fixes).\n- checkpatch: check for missing Fixes tags (stable-fixes).\n- cleanup: Add conditional guard support (stable-fixes).\n- cleanup: Adjust scoped_guard() macros to avoid potential warning (stable-fixes).\n- cleanup: Remove address space of returned pointer (git-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- cpufreq: ACPI: Fix max-frequency computation (git-fixes).\n- cpufreq: Do not unregister cpufreq cooling on CPU hotplug (git-fixes).\n- cpufreq: amd-pstate: remove global header file (git-fixes).\n- cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization (bsc#1234619).\n- cpufreq: intel_pstate: Drop redundant locking from intel_pstate_driver_cleanup() (bsc#1234619).\n- cpufreq: intel_pstate: Fix unchecked HWP MSR access (bsc#1234619).\n- cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller (bsc#1234619).\n- cpufreq: intel_pstate: Get rid of unnecessary READ_ONCE() annotations (bsc#1234619).\n- cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock (git-fixes).\n- cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE() (bsc#1234619).\n- cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Refine computation of P-state for given frequency (bsc#1234619).\n- cpufreq: intel_pstate: Replace three global.turbo_disabled checks (bsc#1234619).\n- cpufreq: intel_pstate: Revise global turbo disable check (bsc#1234619).\n- cpufreq: intel_pstate: Simplify spinlock locking (bsc#1234619).\n- cpufreq: intel_pstate: Update the maximum CPU frequency consistently (bsc#1234619).\n- cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing (git-fixes).\n- cpufreq: intel_pstate: Use __ro_after_init for three variables (bsc#1234619).\n- cpufreq: intel_pstate: Wait for canceled delayed work to complete (bsc#1234619).\n- cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back (git-fixes).\n- cpuidle: Avoid potential overflow in integer multiplication (git-fixes).\n- cpupower: fix TSC MHz calculation (git-fixes).\n- crypto: caam - use JobR's space to access page 0 regs (git-fixes).\n- crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes (git-fixes).\n- crypto: ecdsa - Avoid signed integer overflow on signature decoding (stable-fixes).\n- crypto: ecdsa - Convert byte arrays with key coordinates to digits (stable-fixes).\n- crypto: ecdsa - Rename keylen to bufsize where necessary (stable-fixes).\n- crypto: ecdsa - Use ecc_digits_from_bytes to convert signature (stable-fixes).\n- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async' (git-fixes).\n- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: qce - fix goto jump in error path (git-fixes).\n- crypto: qce - fix priority to be less than ARMv8 CE (git-fixes).\n- crypto: qce - unregister previously registered algos in error path (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devcoredump: cleanup some comments (git-fixes).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dlm: fix possible lkb_resource null dereference (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- dmaengine: ti: edma: fix OF node reference leaks in edma_driver (git-fixes).\n- docs: media: update location of the media patches (stable-fixes).\n- docs: power: Fix footnote reference for Toshiba Satellite P10-554 (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() (git-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers/card_reader/rtsx_usb: Restore interrupt based detection (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Add check for granularity in dml ceil/floor helpers (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix DSC-re-computing (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Fix incorrect DSC recompute trigger (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use HW lock mgr for PSR1 (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/display: increase MAX_SURFACES to the value supported by hw (stable-fixes).\n- drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config() (git-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared under SRIOV (git-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table (git-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: always sync the GFX pipe on ctx switch (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: simplify return statement in amdgpu_ras_eeprom_init (git-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini() (git-fixes).\n- drm/amdkfd: Correct the migration DMA map direction (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: fixed page fault when enable MES shader debugger (git-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: Fix page property being used for non writecombine buffers (git-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915/fb: Relax clear color alignment to 64 bytes (stable-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/mediatek: Add return value check when reading DPCD (git-fixes).\n- drm/mediatek: Add support for 180-degree rotation in the display driver (git-fixes).\n- drm/mediatek: Fix YCbCr422 color format issue for DP (git-fixes).\n- drm/mediatek: Fix mode valid issue for dp (git-fixes).\n- drm/mediatek: Set private-\u003eall_drm_private[i]-\u003edrm to NULL if mtk_drm_bind returns err (git-fixes).\n- drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188 (git-fixes).\n- drm/mediatek: stop selecting foreign drivers (git-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/msm/dp: set safe_to_exit_level before printing it (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550 (git-fixes).\n- drm/msm: Check return value of of_dma_configure() (git-fixes).\n- drm/msm: do not clean up priv-\u003ekms prematurely (git-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/rcar-du: dsi: Fix PHY lock bit check (git-fixes).\n- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() (git-fixes).\n- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8 (git-fixes).\n- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset (git-fixes).\n- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0 (git-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/tidss: Clear the interrupt status for interrupts being disabled (git-fixes).\n- drm/tidss: Fix issue in irq handling causing irq-flood issue (git-fixes).\n- drm/v3d: Assign job pointer to NULL before signaling the fence (git-fixes).\n- drm/v3d: Ensure job pointer is set to NULL after job completion (git-fixes).\n- drm/v3d: Stop active perfmon if it is being destroyed (git-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm/vmwgfx: Add new keep_resv BO param (git-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: ensure that ctime is updated whenever the mtime is (git-fixes).\n- exfat: fix the infinite loop in __exfat_free_cluster() (git-fixes).\n- exfat: fix the infinite loop in exfat_readdir() (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (https://bugzilla.kernel.org/show_bug.cgi?id=216322 bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() (git-fixes).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- genirq: Make handle_enforce_irqctx() unconditionally available (git-fixes).\n- genksyms: fix memory leak when the same symbol is added from source (git-fixes).\n- genksyms: fix memory leak when the same symbol is read from *.symref file (git-fixes).\n- gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- gpio: mxc: remove dead code after switch to DT-only (git-fixes).\n- gpio: xilinx: Convert gpio_lock to raw spinlock (git-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur (git-fixes).\n- hwmon: (drivetemp) Set scsi command timeout to 10s (stable-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use \"proxy\" headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix division of negative numbers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- hyperv: Do not overlap the hvcall IO areas in get_vtl() (git-fixes).\n- i2c: core: fix reference leak in i2c_register_adapter() (git-fixes).\n- i2c: i801: Add support for Intel Arrow Lake-H (stable-fixes).\n- i2c: i801: Add support for Intel Panther Lake (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix \"ghost\" detections (git-fixes).\n- i2c: mux: demux-pinctrl: check initial mux selection, too (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: rcar: fix NACK handling when being a target (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (stable-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ibmvnic: Free any outstanding tx skbs during scrq reset (bsc#1226980).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() (git-fixes).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: adc: ad7124: Disable all channels at probe time (git-fixes).\n- iio: adc: ad_sigma_delta: Handle CS assertion as intended in ad_sd_read_reg_raw() (git-fixes).\n- iio: adc: at91: call input_free_device() on allocated iio_dev (git-fixes).\n- iio: adc: rockchip_saradc: fix information leak in triggered buffer (git-fixes).\n- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() (git-fixes).\n- iio: adc: ti-ads8688: fix information leak in triggered buffer (git-fixes).\n- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (git-fixes).\n- iio: gyro: fxas21002c: Fix missing data update in trigger handler (git-fixes).\n- iio: iio-mux: kzalloc instead of devm_kzalloc to ensure page alignment (git-fixes).\n- iio: imu: kmx61: fix information leak in triggered buffer (git-fixes).\n- iio: inkern: call iio_device_put() only on mapped devices (git-fixes).\n- iio: light: as73211: fix channel handling in only-color triggered buffer (git-fixes).\n- iio: light: vcnl4035: fix information leak in triggered buffer (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- iio: pressure: zpa2326: fix information leak in triggered buffer (git-fixes).\n- iio: test : check null return of kunit_kmalloc in iio_rescale_test_scale (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- intel_th: core: fix kernel-doc warnings (git-fixes).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- ipmi: ipmb: Add check devm_kasprintf() returned value (git-fixes).\n- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response (git-fixes).\n- irqchip/gic-v3: Force propagation of the active state with a read-back (stable-fixes).\n- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base (stable-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct auto_pin_cfg_item change (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- kheaders: Ignore silly-rename files (stable-fixes).\n- ktest.pl: Avoid false positives with grub2 skip regex (stable-fixes).\n- ktest.pl: Check kernelrelease return in get_version (git-fixes).\n- ktest.pl: Fix typo \"accesing\" (git-fixes).\n- ktest.pl: Fix typo in comment (git-fixes).\n- ktest.pl: Remove unused declarations in run_bisect_test function (git-fixes).\n- ktest: force $buildonly = 1 for 'make_warnings_file' test type (stable-fixes).\n- landlock: Handle weird files (git-fixes).\n- latencytop: use correct kernel-doc format for func params (git-fixes).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- leds: lp8860: Write full EEPROM, not only half of it (git-fixes).\n- leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata() (git-fixes).\n- lib/inflate.c: remove dead code (git-fixes).\n- lib/stackdepot: print disabled message only if truly disabled (git-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- mac802154: check local interfaces before deleting sdata list (stable-fixes).\n- mailbox: pcc: Add support for platform notification handling (stable-fixes).\n- mailbox: pcc: Support shared interrupt for multiple subspaces (stable-fixes).\n- mailbox: tegra-hsp: Clear mailbox before using message (git-fixes).\n- maple_tree: simplify split calculation (git-fixes).\n- media: camif-core: Add check for clk_enable() (git-fixes).\n- media: ccs: Clean up parsed CCS static data on parse failure (git-fixes).\n- media: ccs: Fix CCS static data parsing for large block sizes (git-fixes).\n- media: ccs: Fix cleanup order in ccs_probe() (git-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer (git-fixes).\n- media: i2c: imx412: Add missing newline to prints (git-fixes).\n- media: i2c: ov9282: Correct the exposure offset (git-fixes).\n- media: imx-jpeg: Fix potential error pointer dereference in detach_pm() (git-fixes).\n- media: imx296: Add standby delay during probe (git-fixes).\n- media: lmedm04: Handle errors for lme2510_int_read (git-fixes).\n- media: marvell: Add check for clk_enable() (git-fixes).\n- media: mc: fix endpoint iteration (git-fixes).\n- media: mipi-csis: Add check for clk_enable() (git-fixes).\n- media: nxp: imx8-isi: fix v4l2-compliance test errors (git-fixes).\n- media: ov5640: fix get_light_freq on auto (git-fixes).\n- media: rc: iguanair: handle timeouts (git-fixes).\n- media: rkisp1: Fix unused value issue (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: Fix crash during unbind if gpio unit is in use (git-fixes).\n- media: uvcvideo: Fix double free in error path (git-fixes).\n- media: uvcvideo: Fix event flags in uvc_ctrl_send_events (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4035 (stable-fixes).\n- media: uvcvideo: Only save async fh if success (git-fixes).\n- media: uvcvideo: Propagate buf-\u003eerror to userspace (git-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- media: uvcvideo: Remove dangling pointers (git-fixes).\n- media: uvcvideo: Remove redundant NULL assignment (git-fixes).\n- media: uvcvideo: Support partial control reads (git-fixes).\n- memory tiering: count PGPROMOTE_SUCCESS when mem tiering is enabled (git-fixes).\n- memory-failure: use a folio in me_huge_page() (git-fixes).\n- memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() (git-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- misc: fastrpc: Deregister device nodes properly in error scenarios (git-fixes).\n- misc: fastrpc: Fix copy buffer page size (git-fixes).\n- misc: fastrpc: Fix registered buffer page address (git-fixes).\n- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling (git-fixes).\n- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config (git-fixes).\n- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm,page_owner: do not remove __GFP_NOLOCKDEP in add_stack_record_to_list (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/memory-failure: cast index to loff_t before shifting it (git-fixes).\n- mm/memory-failure: check the mapcount of the precise page (git-fixes).\n- mm/memory-failure: fix crash in split_huge_page_to_list from soft_offline_page (git-fixes).\n- mm/memory-failure: pass the folio and the page to collect_procs() (git-fixes).\n- mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu (git-fixes).\n- mm/memory_hotplug: add missing mem_hotplug_lock (git-fixes).\n- mm/memory_hotplug: fix error handling in add_memory_resource() (git-fixes).\n- mm/memory_hotplug: prevent accessing by index=-1 (git-fixes).\n- mm/memory_hotplug: use pfn math in place of direct struct page manipulation (git-fixes).\n- mm/migrate: correct nr_failed in migrate_pages_sync() (git-fixes).\n- mm/migrate: fix deadlock in migrate_pages_batch() on large folios (git-fixes).\n- mm/migrate: putback split folios when numa hint migration fails (git-fixes).\n- mm/migrate: split source folio if it is on deferred split list (git-fixes).\n- mm/page_owner: remove free_ts from page_owner output (git-fixes).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mm/rodata_test: use READ_ONCE() to read const variable (git-fixes).\n- mm: convert DAX lock/unlock page to lock/unlock folio (git-fixes).\n- mm: memory-failure: ensure moving HWPoison flag to the raw error pages (git-fixes).\n- mm: memory-failure: fetch compound head after extra page refcnt is held (git-fixes).\n- mm: memory-failure: fix potential page refcnt leak in memory_failure() (git-fixes).\n- mm: memory-failure: fix race window when trying to get hugetlb folio (git-fixes).\n- mm: memory-failure: remove unneeded PageHuge() check (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- modpost: fix the missed iteration for the max bit in do_input() (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: onenand: Fix uninitialized retlen in do_otp_read() (git-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- mtd: spinand: Remove write_enable_op() in markbad() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting \"num_images\" to work (git-fixes).\n- net/rose: prevent integer overflows in rose_setsockopt() (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset (git-fixes).\n- net: rose: fix timer races against user threads (git-fixes).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- net: usb: qmi_wwan: add Telit FE910C04 compositions (stable-fixes).\n- net: usb: rtl8150: enable basic endpoint checking (git-fixes).\n- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() (git-fixes).\n- net: wwan: t7xx: Fix FSM command timeout issue (git-fixes).\n- netfilter: nf_tables: validate family when identifying table via handle (bsc#1233778 ZDI-24-1454).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix possible int overflows in nilfs_fiemap() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: Add error check for xa_store in nvme_get_effects_log (git-fixes).\n- nvme: Add error path for xa_store in nvme_init_effects (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix bogus kzalloc() return check in nvme_init_effects_log() (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- nvmet: propagate npwg topology (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- padata: add pd get/put refcnt helper (git-fixes).\n- padata: avoid UAF for reorder_work (git-fixes).\n- padata: fix UAF in padata_reorder (git-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: amd: Take suspend type into consideration which pins are non-wake (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails (git-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it (git-fixes).\n- platform/x86/intel-uncore-freq: Ignore minor version change (bsc#1225897).\n- platform/x86/intel/tpmi: Add defines to get version information (bsc#1225897).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- pm:cpupower: Add missing powercap_set_enabled() stub function (git-fixes).\n- power: ip5xxx_power: Fix return value on ADC read errors (git-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- powerpc/iommu: Move pSeries specific functions to pseries/iommu.c (bsc#1220711 ltc#205755).\n- powerpc/iommu: Only build sPAPR access functions on pSeries (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove MVE code (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove ioda1 support (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove last IODA1 defines (bsc#1220711 ltc#205755).\n- powerpc/pseries/eeh: Fix get PE state translation (bsc#1215199).\n- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).\n- powerpc/pseries/vas: Add close() callback in vas_vm_ops struct (bsc#1234825).\n- pps: add an error check in parport_attach (git-fixes).\n- pps: remove usage of the deprecated ida_simple_xx() API (stable-fixes).\n- printk: Add is_printk_legacy_deferred() (bsc#1236733).\n- printk: Defer legacy printing when holding printk_cpu_sync (bsc#1236733).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- pwm: stm32-lp: Add check for clk_enable() (git-fixes).\n- pwm: stm32: Add check for clk_enable() (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- rcu-tasks: Pull sampling of -\u003epercpu_dequeue_lim out of loop (git-fixes)\n- rcu/tree: Defer setting of jiffies during stall reset (git-fixes)\n- rcu: Dump memory object info if callback function is invalid (git-fixes)\n- rcu: Eliminate rcu_gp_slow_unregister() false positive (git-fixes)\n- rcuscale: Move rcu_scale_writer() (git-fixes)\n- rdma/cxgb4: Prevent potential integer overflow on 32bit (git-fixes)\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: core: Add missing newline character (git-fixes).\n- regulator: of: Implement the unwind path of of_regulator_match() (git-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- remoteproc: core: Fix ida_free call while not allocated (git-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (git-fixes).\n- rtc: zynqmp: Fix optional clock name property (git-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- s390x config: IOMMU_DEFAULT_DMA_LAZY=y (bsc#1235646)\n- samples/landlock: Fix possible NULL dereference in parse_path() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat (bsc#1235865).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat -kabi (bsc#1235865).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (git-fixes).\n- seccomp: Stub for !CONFIG_SECCOMP (stable-fixes).\n- selftest: media_tests: fix trivial UAF typo (git-fixes).\n- selftests/alsa: Fix circular dependency involving global-timer (stable-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- selftests/landlock: Fix error message (git-fixes).\n- selftests/mm/cow: modify the incorrect checking parameters (git-fixes).\n- selftests/powerpc: Fix argument order to timer_sub() (git-fixes).\n- selftests: harness: fix printing of mismatch values in __EXPECT() (git-fixes).\n- selftests: mptcp: avoid spurious errors on disconnect (git-fixes).\n- selftests: tc-testing: reduce rshift value (stable-fixes).\n- selftests: timers: clocksource-switch: Adapt progress to kselftest framework (git-fixes).\n- selinux: Fix SCTP error inconsistency in selinux_socket_bind() (git-fixes).\n- serial: 8250: Adjust the timeout for FIFO mode (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use (git-fixes).\n- serial: sh-sci: Drop __initdata macro for port_cfg (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- series.conf: temporarily disable upstream patch patches.suse/ocfs2-fix-UBSAN-warning-in-ocfs2_verify_volume.patch (bsc#1236138)\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: atmel: fix device_node release in atmel_soc_device_init() (git-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths (git-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: smem_state: fix missing of_node_put in error path (git-fixes).\n- soc: qcom: socinfo: Avoid out of bounds read of serial number (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- sound: usb: enable DSD output for ddHiFi TC44C (stable-fixes).\n- sound: usb: format: do not warn that raw DSD is unsupported (stable-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- spi: zynq-qspi: Add check for clk_enable() (git-fixes).\n- srcu: Fix srcu_struct node grpmask overflow on 64-bit systems (git-fixes)\n- srcu: Only accelerate on enqueue time (git-fixes)\n- stackdepot: rename pool_index to pool_index_plus_1 (git-fixes).\n- stackdepot: respect __GFP_NOLOCKDEP allocation flag (git-fixes).\n- staging: iio: ad9832: Correct phase range check (git-fixes).\n- staging: iio: ad9834: Correct phase range check (git-fixes).\n- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() (git-fixes).\n- staging: media: max96712: fix kernel oops when removing module (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- supported.conf: Add support for v4l2-dv-timings (jsc#PED-8645)\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- thermal: of: fix OF node leak in of_thermal_zone_find() (git-fixes).\n- thunderbolt: Add support for Intel Lunar Lake (stable-fixes).\n- thunderbolt: Add support for Intel Panther Lake-M/P (stable-fixes).\n- tipc: fix NULL deref in cleanup_bearer() (bsc#1235433).\n- tools: Sync if_xdp.h uapi tooling header (git-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm: Map the ACPI provided event log (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: 8250: Fix another runtime PM usage counter underflow (git-fixes).\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- ubifs: skip dumping tnc tree when zroot is null (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- uio: Fix return value of poll (git-fixes).\n- uio: uio_dmem_genirq: check the return value of devm_kasprintf() (git-fixes).\n- usb-storage: Add max sectors quirk for Nokia 208 (stable-fixes).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3-am62: Disable autosuspend during remove (git-fixes).\n- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk() (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: gadget: fix writing NYET threshold (git-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: fix reference leak in usb_new_device() (git-fixes).\n- usb: gadget: configfs: Ignore trailing LF for user strings to cdev (git-fixes).\n- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (git-fixes).\n- usb: gadget: f_tcm: Decrement command ref count on cleanup (git-fixes).\n- usb: gadget: f_tcm: Do not free command immediately (git-fixes).\n- usb: gadget: f_tcm: Do not prepare BOT write request twice (git-fixes).\n- usb: gadget: f_tcm: Fix Get/SetInterface return value (git-fixes).\n- usb: gadget: f_tcm: Translate error to sense (git-fixes).\n- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint (git-fixes).\n- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints (git-fixes).\n- usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: host: xhci-plat: Assign shared_hcd-\u003ersrc_start (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() (bsc#1235001)\n- usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() (git-fixes).\n- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- usbnet: ipheth: break up NCM header size computation (git-fixes).\n- usbnet: ipheth: check that DPE points past NCM header (git-fixes).\n- usbnet: ipheth: fix DPE OoB read (git-fixes).\n- usbnet: ipheth: fix possible overflow in DPE length check (git-fixes).\n- usbnet: ipheth: refactor NCM datagram loop (git-fixes).\n- usbnet: ipheth: use static NDP16 location in URB (git-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- vmscan,migrate: fix page count imbalance on node stats when demoting pages (git-fixes).\n- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler (stable-fixes).\n- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset (stable-fixes).\n- watchdog: rzg2l_wdt: Remove reset de-assert from probe (stable-fixes).\n- wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855 (git-fixes).\n- wifi: ath11k: cleanup struct ath11k_mon_data (git-fixes).\n- wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() (stable-fixes).\n- wifi: ath12k: fix tx power, max reg power update to firmware (git-fixes).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: brcmfmac: add missing header include for brcmf_dbg (git-fixes).\n- wifi: cfg80211: adjust allocation of colocated AP data (git-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: fw: read STEP table from correct UEFI var (git-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: Add non-atomic station iterator (stable-fixes).\n- wifi: mac80211: Fix common size calculation for ML element (git-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: do not flush non-uploaded STAs (git-fixes).\n- wifi: mac80211: export ieee80211_purge_tx_queue() for drivers (stable-fixes).\n- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: fix tid removal during mesh forwarding (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: mac80211: prohibit deactivating all links (git-fixes).\n- wifi: mac80211: wake the queues in case of failure in resume (stable-fixes).\n- wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO (git-fixes).\n- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC (git-fixes).\n- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 (git-fixes).\n- wifi: mt76: mt7915: firmware restart on devices with a second pcie link (git-fixes).\n- wifi: mt76: mt7915: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7915: fix register mapping (git-fixes).\n- wifi: mt76: mt7921: fix using incorrect group cipher after disconnection (git-fixes).\n- wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (git-fixes).\n- wifi: mt76: mt7996: add max mpdu len capability (git-fixes).\n- wifi: mt76: mt7996: fix HE Phy capability (git-fixes).\n- wifi: mt76: mt7996: fix definition of tx descriptor (git-fixes).\n- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event (git-fixes).\n- wifi: mt76: mt7996: fix ldpc setting (git-fixes).\n- wifi: mt76: mt7996: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7996: fix register mapping (git-fixes).\n- wifi: mt76: mt7996: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtlwifi: destroy workqueue at rtl_deinit_core (git-fixes).\n- wifi: rtlwifi: do not complete firmware loading needlessly (git-fixes).\n- wifi: rtlwifi: fix init_sw_vars leak when probe fails (git-fixes).\n- wifi: rtlwifi: fix memory leaks and invalid access at probe error path (git-fixes).\n- wifi: rtlwifi: pci: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtlwifi: remove unused check_buddy_priv (git-fixes).\n- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix media status report (git-fixes).\n- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop (git-fixes).\n- wifi: rtlwifi: usb: fix workqueue leak when probe fails (git-fixes).\n- wifi: rtlwifi: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- wifi: rtw89: mcc: consider time limits not divisible by 1024 (git-fixes).\n- wifi: wcn36xx: fix channel survey memory allocation size (git-fixes).\n- wifi: wlcore: fix unbalanced pm_runtime calls (git-fixes).\n- workqueue: Add rcu lock check at the end of work item execution (bsc#1236732).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0 (git-fixes).\n- xfs: Add error handling for xfs_reflink_cancel_cow_range (git-fixes).\n- xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-03-28T07:51:47Z","modified":"2026-03-23T04:50:04.890383Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20248-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).\n- CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).\n- CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).\n- CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).\n- CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).\n- CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).\n- CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized\n  delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).\n- CVE-2024-53170: block: fix uaf for flush rq while iterating tags (bsc#1234888).\n- CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).\n- CVE-2024-53175: ipc: fix memleak if msg_init_ns failed in create_ipc_ns (bsc#1234893).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey() (bsc#1234901).\n- CVE-2024-53187: io_uring: check for overflows in io_pin_pages (bsc#1234947).\n- CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use (bsc#1234957).\n- CVE-2024-53196: KVM: arm64: Do not retire aborted MMIO instruction (bsc#1234906).\n- CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).\n- CVE-2024-53203: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit() (bsc#1235011).\n- CVE-2024-53232: iommu/s390: Implement blocking domain (bsc#1235050).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53236: xsk: Free skb when TX metadata options are invalid (bsc#1235000).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-53685: ceph: give up on paths longer than PATH_MAX (bsc#1235720).\n- CVE-2024-55639: net: renesas: rswitch: avoid use-after-put for a device tree node (bsc#1235737).\n- CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit() (bsc#1235745).\n- CVE-2024-56372: net: tun: fix tun_napi_alloc_frags() (bsc#1235753).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).\n- CVE-2024-56569: ftrace: Fix regression with module command in stack_trace_filter (bsc#1235031).\n- CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization (bsc#1235123).\n- CVE-2024-56589: scsi: hisi_sas: Add cond_resched() for no forced preemption model (bsc#1235241).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).\n- CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).\n- CVE-2024-56602: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (bsc#1235521).\n- CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create() (bsc#1235415).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56608: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487).\n- CVE-2024-56610: kcsan: Turn report_filterlist_lock into a raw_spinlock (bsc#1235390).\n- CVE-2024-56611: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (bsc#1235391).\n- CVE-2024-56614: xsk: fix OOB map writes when deleting elements (bsc#1235424).\n- CVE-2024-56615: bpf: fix OOB devmap writes when deleting elements (bsc#1235426).\n- CVE-2024-56617: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU (bsc#1235429).\n- CVE-2024-56620: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled (bsc#1235227).\n- CVE-2024-56622: scsi: ufs: core: sysfs: Prevent div by zero (bsc#1235251).\n- CVE-2024-56631: scsi: sg: Fix slab-use-after-free read in sg_release() (bsc#1235480).\n- CVE-2024-56635: net: avoid potential UAF in default_operstate() (bsc#1235519).\n- CVE-2024-56636: geneve: do not assume mac header is set in geneve_xmit_skb() (bsc#1235520).\n- CVE-2024-56637: netfilter: ipset: Hold module reference while requesting a module (bsc#1235523).\n- CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).\n- CVE-2024-56643: dccp: Fix memory leak in dccp_feat_change_recv (bsc#1235132).\n- CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fill_frame_info() (bsc#1235451).\n- CVE-2024-56649: net: enetc: Do not configure preemptible TCs if SIs do not support (bsc#1235449).\n- CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430).\n- CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips (bsc#1235444).\n- CVE-2024-56659: net: lapb: increase LAPB_HEADER_LEN (bsc#1235439).\n- CVE-2024-56660: net/mlx5: DR, prevent potential error pointer dereference (bsc#1235437).\n- CVE-2024-56664: bpf, sockmap: Fix race between element replace and close() (bsc#1235249).\n- CVE-2024-56665: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog (bsc#1235489).\n- CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (bsc#1235555).\n- CVE-2024-56679: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (bsc#1235498).\n- CVE-2024-56693: brd: defer automatic disk creation until module initialization succeeds (bsc#1235418).\n- CVE-2024-56694: bpf: fix recursive lock when verdict program return SK_PASS (bsc#1235412).\n- CVE-2024-56704: 9p/xen: fix release of IRQ (bsc#1235584).\n- CVE-2024-56707: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (bsc#1235545).\n- CVE-2024-56708: EDAC/igen6: Avoid segmentation fault on module unload (bsc#1235564).\n- CVE-2024-56712: udmabuf: fix memory leak on last export_udmabuf() error path (bsc#1235565).\n- CVE-2024-56715: ionic: Fix netdev notifier unregister on failure (bsc#1235612).\n- CVE-2024-56716: netdevsim: prevent bad user input in nsim_dev_health_break_write() (bsc#1235587).\n- CVE-2024-56725: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c (bsc#1235578).\n- CVE-2024-56726: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c (bsc#1235582).\n- CVE-2024-56727: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (bsc#1235583).\n- CVE-2024-56728: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (bsc#1235656).\n- CVE-2024-56729: smb: Initialize cfid-\u003etcon before performing network ops (bsc#1235503).\n- CVE-2024-56747: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (bsc#1234934).\n- CVE-2024-56748: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (bsc#1235627).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n- CVE-2024-56759: btrfs: fix use-after-free when COWing tree bock and tracing is enabled (bsc#1235645).\n- CVE-2024-56763: tracing: Prevent bad count for tracing_cpumask_write (bsc#1235638).\n- CVE-2024-56774: btrfs: add a sanity check for btrfs root in btrfs_search_slot() (bsc#1235653).\n- CVE-2024-56775: drm/amd/display: Fix handling of plane refcount (bsc#1235657).\n- CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data (bsc#1235759).\n- CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235768).\n- CVE-2024-57795: RDMA/rxe: Remove the direct link to net_device (bsc#1235906).\n- CVE-2024-57801: net/mlx5e: Skip restore TC rules for vport rep without loaded flag (bsc#1235940).\n- CVE-2024-57802: netrom: check buffer length before accessing it (bsc#1235941).\n- CVE-2024-57804: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (bsc#1235779).\n- CVE-2024-57809: PCI: imx6: Fix suspend/resume support on i.MX6QDL (bsc#1235793).\n- CVE-2024-57838: s390/entry: Mark IRQ entries to fix stack depot warnings (bsc#1235798).\n- CVE-2024-57857: RDMA/siw: Remove direct link to net_device (bsc#1235946).\n- CVE-2024-57884: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (bsc#1235948).\n- CVE-2024-57892: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (bsc#1235964).\n- CVE-2024-57896: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (bsc#1235965).\n- CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets (bsc#1235967).\n- CVE-2024-57917: topology: Keep the cpumask unchanged when printing cpumap (bsc#1236127).\n- CVE-2024-57929: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (bsc#1236096).\n- CVE-2024-57931: selinux: ignore unknown extended permissions (bsc#1236192).\n- CVE-2024-57932: gve: guard XDP xmit NDO on existence of xdp queues (bsc#1236190).\n- CVE-2024-57933: gve: guard XSK operations on the existence of queues (bsc#1236178).\n- CVE-2024-57938: net/sctp: Prevent autoclose integer overflow in sctp_association_init() (bsc#1236182).\n- CVE-2024-57946: virtio-blk: do not keep queue frozen during system suspend (bsc#1236247).\n- CVE-2025-21632: x86/fpu: Ensure shadow stack is active before \"getting\" registers (bsc#1236106).\n- CVE-2025-21649: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (bsc#1236143).\n- CVE-2025-21650: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue (bsc#1236144).\n- CVE-2025-21651: net: hns3: do not auto enable misc vector (bsc#1236145).\n- CVE-2025-21652: ipvlan: Fix use-after-free in ipvlan_get_iflink() (bsc#1236160).\n- CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (bsc#1236161).\n- CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (bsc#1236163).\n- CVE-2025-21662: net/mlx5: Fix variable not being completed when function returns (bsc#1236198).\n- CVE-2025-21663: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (bsc#1236260).\n- CVE-2025-21664: dm thin: make get_first_thin use rcu-safe list first function (bsc#1236262).\n- CVE-2025-21674: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (bsc#1236688).\n- CVE-2025-21676: net: fec: handle page_pool_dev_alloc_pages error (bsc#1236696).\n- CVE-2025-21682: eth: bnxt: always recalculate features after XDP clearing, fix null-deref (bsc#1236703).\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A (stable-fixes).\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 (stable-fixes).\n- ACPI: PCC: Add PCC shared memory region command and status bitfields (stable-fixes).\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: fan: cleanup resources in the error path of .probe() (git-fixes).\n- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] (stable-fixes).\n- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] (stable-fixes).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: resource: acpi_dev_irq_override(): Check DMI match last (stable-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio (stable-fixes).\n- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop (git-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model (stable-fixes).\n- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA (stable-fixes).\n- ALSA: hda/realtek: Add support for Galaxy Book2 Pro (NP950XEE) (stable-fixes).\n- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx (stable-fixes).\n- ALSA: hda/realtek: Enable headset mic on Positivo C6400 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (bsc#1235686).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Fix headset detection failure due to unstable sort (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for USB Audio Device (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ASoC: Intel: avs: Fix theoretical infinite loop (git-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: acp: Support microphone from Lenovo Go S (stable-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: mediatek: disable buffer pre-allocation (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback (git-fixes).\n- ASoC: rt722: add delay time to wait for the calibration procedure (stable-fixes).\n- ASoC: samsung: Add missing depends on I2C (git-fixes).\n- ASoC: samsung: Add missing selects for MFD_WM8994 (stable-fixes).\n- ASoC: sun4i-spdif: Add clock multiplier settings (git-fixes).\n- ASoC: wm8994: Add depends on MFD core (stable-fixes).\n- Bluetooth: Add support ITTIM PE50-M75C (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection (git-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (git-fixes).\n- Bluetooth: MGMT: Fix Add Device to responding before completing (git-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btnxpuart: Fix driver sending truncated data (git-fixes).\n- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming (git-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 (stable-fixes).\n- Bluetooth: btusb: add callback function in btusb suspend/resume (stable-fixes).\n- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: hci_sync: Fix not setting Random Address when required (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Delete XHCI patch for regression (bsc#1235550)\n- Disable ceph (jsc#PED-7242)\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- Drop downstream TPM fix patch (bsc#1233260 bsc#1233259 bsc#1232421)\n- Drop uvcvideo fix due to regression (bsc#1235894)\n- EDAC/{i10nm,skx,skx_common}: Support UV systems (bsc#1234693).\n- HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (git-fixes).\n- HID: fix generic desktop D-Pad controls (git-fixes).\n- HID: hid-sensor-hub: do not use stale platform-data on remove (git-fixes).\n- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- HID: multitouch: fix support for Goodix PID 0x01e9 (git-fixes).\n- Input: atkbd - map F23 key to support default copilot shortcut (stable-fixes).\n- Input: bbnsm_pwrkey - add remove hook (git-fixes).\n- Input: bbnsm_pwrkey - fix missed key press after suspend (git-fixes).\n- Input: davinci-keyscan - remove leftover header (git-fixes).\n- Input: xpad - add QH Electronics VID/PID (stable-fixes).\n- Input: xpad - add support for Nacon Evol-X Xbox One Controller (stable-fixes).\n- Input: xpad - add support for Nacon Pro Compact (stable-fixes).\n- Input: xpad - add support for wooting two he (arm) (stable-fixes).\n- Input: xpad - add unofficial Xbox 360 wireless receiver clone (stable-fixes).\n- Input: xpad - improve name of 8BitDo controller 2dc8:3106 (stable-fixes).\n- KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits (bsc#1234635).\n- KVM: s390: Reject KVM_SET_GSI_ROUTING on ucontrol VMs (git-fixes bsc#1235776).\n- KVM: s390: Reject setting flic pfault attributes on ucontrol VMs (git-fixes bsc#1235777).\n- KVM: s390: vsie: fix virtual/physical address in unpin_scb() (git-fixes bsc#1235778).\n- NFC: nci: Add bounds checking in nci_hci_create_pipe() (git-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation (git-fixes).\n- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq (git-fixes).\n- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (git-fixes).\n- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() (git-fixes).\n- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() (git-fixes).\n- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() (git-fixes).\n- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test (git-fixes).\n- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error (git-fixes).\n- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset() (git-fixes).\n- PCI: imx6: Skip controller_id generation logic for i.MX7D (git-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: microchip: Set inbound address translation for coherent or non-coherent mode (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() (git-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- PM: hibernate: Add error handling for syscore_suspend() (git-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Add send queue size check for variable wqe (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix MSN table size for variable wqe mode (git-fixes)\n- RDMA/bnxt_re: Fix max SGEs for the Work Request (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Fix the max WQE size for static WQE support (git-fixes)\n- RDMA/bnxt_re: Fix the max WQEs used in Static WQE mode (git-fixes)\n- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error (git-fixes)\n- RDMA/bnxt_re: Fix to export port num to ib_query_qp (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx4: Avoid false error about access to uninitialized gids array (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (git-fixes)\n- RDMA/mlx5: Fix implicit ODP use after free (git-fixes)\n- RDMA/mlx5: Fix indirect mkey ODP page count (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/rxe: Fix mismatched max_msg_sz (git-fixes)\n- RDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\" (git-fixes)\n- RDMA/srp: Fix error handling in srp_add_port (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- Revert \"HID: multitouch: Add support for lenovo Y9000P Touchpad\" (stable-fixes).\n- Revert \"block/mq-deadline: use correct way to throttling write requests\" (bsc#1234146).\n- Revert \"btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\"\n- Revert \"drm/i915/dpt: Make DPT object unshrinkable\" (stable-fixes).\n- Revert \"igb: Disable threaded IRQ for igb_msix_other\" (git-fixes).\n- Revert \"mm, kmsan: fix infinite recursion due to RCU critical section\" (bsc#1230413)\n- Revert \"mm/sparsemem: fix race in accessing memory_section-\u003eusage\" (bsc#1230413)\n- Revert \"mm: prevent derefencing NULL ptr in pfn_section_valid()\" (bsc#1230413)\n- Revert \"mtd: spi-nor: core: replace dummy buswidth from addr to data\" (git-fixes).\n- Revert \"unicode: Do not special case ignorable code points\" (stable-fixes).\n- Revert \"usb: gadget: u_serial: Disable ep before setting port to null\n  to fix the crash caused by port being null\" (stable-fixes).\n- Revert 'arm64: Kconfig: Make SME depend on BROKEN for now' \n- Revert 0dd78566990 (\"Disable ceph (jsc#PED-7242)\") \n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: core: Disable LPM only for non-suspended ports (git-fixes).\n- USB: serial: cp210x: add Phoenix Contact UPS Device (stable-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM815 (stable-fixes).\n- USB: serial: option: add Neoway N723-EA support (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (git-fixes).\n- USB: usblp: return error when setting unsupported protocol (git-fixes).\n- VFS: use system_unbound_wq for delayed_mntput (bsc#1234683).\n- VMCI: fix reference to ioctl-number.rst (git-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY (git-fixes).\n- afs: Fix cleanup of immediately failed async calls (git-fixes).\n- afs: Fix directory format encoding struct (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call (git-fixes).\n- afs: Fix the maximum cell name length (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() (git-fixes)\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented (git-fixes)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes bsc#1236245)\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- arm64: dts: rockchip: Add sdmmc/sdio/emmc reset controls for RK3328 (git-fixes)\n- arm64: dts: rockchip: add hevc power domain clock to rk3328 (git-fixes).\n- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma (git-fixes)\n- arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL (git-fixes).\n- arm64: tegra: Disable Tegra234 sce-fabric node (git-fixes)\n- arm64: tegra: Fix Tegra234 PCIe interrupt-map (git-fixes)\n- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible (git-fixes)\n- ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() (stable-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of \"cgroup_mutex or RCU read lock required!\" (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (git-fixes)\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235445).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235445).\n- bus: mhi: host: Free mhi_buf vector inside mhi_alloc_bhie_table() (git-fixes).\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- ceph: improve error handling and short/overflow-read logic in __ceph_sync_read() (bsc#1228592).\n- checkpatch: always parse orig_commit in fixes tag (git-fixes).\n- checkpatch: check for missing Fixes tags (stable-fixes).\n- cleanup: Add conditional guard support (stable-fixes).\n- cleanup: Adjust scoped_guard() macros to avoid potential warning (stable-fixes).\n- cleanup: Remove address space of returned pointer (git-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- cpufreq: ACPI: Fix max-frequency computation (git-fixes).\n- cpufreq: Do not unregister cpufreq cooling on CPU hotplug (git-fixes).\n- cpufreq: amd-pstate: remove global header file (git-fixes).\n- cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization (bsc#1234619).\n- cpufreq: intel_pstate: Drop redundant locking from intel_pstate_driver_cleanup() (bsc#1234619).\n- cpufreq: intel_pstate: Fix unchecked HWP MSR access (bsc#1234619).\n- cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller (bsc#1234619).\n- cpufreq: intel_pstate: Get rid of unnecessary READ_ONCE() annotations (bsc#1234619).\n- cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock (git-fixes).\n- cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE() (bsc#1234619).\n- cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Refine computation of P-state for given frequency (bsc#1234619).\n- cpufreq: intel_pstate: Replace three global.turbo_disabled checks (bsc#1234619).\n- cpufreq: intel_pstate: Revise global turbo disable check (bsc#1234619).\n- cpufreq: intel_pstate: Simplify spinlock locking (bsc#1234619).\n- cpufreq: intel_pstate: Update the maximum CPU frequency consistently (bsc#1234619).\n- cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing (git-fixes).\n- cpufreq: intel_pstate: Use __ro_after_init for three variables (bsc#1234619).\n- cpufreq: intel_pstate: Wait for canceled delayed work to complete (bsc#1234619).\n- cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back (git-fixes).\n- cpuidle: Avoid potential overflow in integer multiplication (git-fixes).\n- cpupower: fix TSC MHz calculation (git-fixes).\n- crypto: caam - use JobR's space to access page 0 regs (git-fixes).\n- crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes (git-fixes).\n- crypto: ecdsa - Avoid signed integer overflow on signature decoding (stable-fixes).\n- crypto: ecdsa - Convert byte arrays with key coordinates to digits (stable-fixes).\n- crypto: ecdsa - Rename keylen to bufsize where necessary (stable-fixes).\n- crypto: ecdsa - Use ecc_digits_from_bytes to convert signature (stable-fixes).\n- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async' (git-fixes).\n- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: qce - fix goto jump in error path (git-fixes).\n- crypto: qce - fix priority to be less than ARMv8 CE (git-fixes).\n- crypto: qce - unregister previously registered algos in error path (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devcoredump: cleanup some comments (git-fixes).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dlm: fix possible lkb_resource null dereference (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- dmaengine: ti: edma: fix OF node reference leaks in edma_driver (git-fixes).\n- docs: media: update location of the media patches (stable-fixes).\n- docs: power: Fix footnote reference for Toshiba Satellite P10-554 (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() (git-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers/card_reader/rtsx_usb: Restore interrupt based detection (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Add check for granularity in dml ceil/floor helpers (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix DSC-re-computing (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Fix incorrect DSC recompute trigger (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use HW lock mgr for PSR1 (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/display: increase MAX_SURFACES to the value supported by hw (stable-fixes).\n- drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config() (git-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared under SRIOV (git-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table (git-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: always sync the GFX pipe on ctx switch (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: simplify return statement in amdgpu_ras_eeprom_init (git-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini() (git-fixes).\n- drm/amdkfd: Correct the migration DMA map direction (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: fixed page fault when enable MES shader debugger (git-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: Fix page property being used for non writecombine buffers (git-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915/fb: Relax clear color alignment to 64 bytes (stable-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/mediatek: Add return value check when reading DPCD (git-fixes).\n- drm/mediatek: Add support for 180-degree rotation in the display driver (git-fixes).\n- drm/mediatek: Fix YCbCr422 color format issue for DP (git-fixes).\n- drm/mediatek: Fix mode valid issue for dp (git-fixes).\n- drm/mediatek: Set private-\u003eall_drm_private[i]-\u003edrm to NULL if mtk_drm_bind returns err (git-fixes).\n- drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188 (git-fixes).\n- drm/mediatek: stop selecting foreign drivers (git-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/msm/dp: set safe_to_exit_level before printing it (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550 (git-fixes).\n- drm/msm: Check return value of of_dma_configure() (git-fixes).\n- drm/msm: do not clean up priv-\u003ekms prematurely (git-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/rcar-du: dsi: Fix PHY lock bit check (git-fixes).\n- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() (git-fixes).\n- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8 (git-fixes).\n- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset (git-fixes).\n- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0 (git-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/tidss: Clear the interrupt status for interrupts being disabled (git-fixes).\n- drm/tidss: Fix issue in irq handling causing irq-flood issue (git-fixes).\n- drm/v3d: Assign job pointer to NULL before signaling the fence (git-fixes).\n- drm/v3d: Ensure job pointer is set to NULL after job completion (git-fixes).\n- drm/v3d: Stop active perfmon if it is being destroyed (git-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm/vmwgfx: Add new keep_resv BO param (git-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: ensure that ctime is updated whenever the mtime is (git-fixes).\n- exfat: fix the infinite loop in __exfat_free_cluster() (git-fixes).\n- exfat: fix the infinite loop in exfat_readdir() (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() (git-fixes).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- genirq: Make handle_enforce_irqctx() unconditionally available (git-fixes).\n- genksyms: fix memory leak when the same symbol is added from source (git-fixes).\n- genksyms: fix memory leak when the same symbol is read from *.symref file (git-fixes).\n- gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- gpio: mxc: remove dead code after switch to DT-only (git-fixes).\n- gpio: xilinx: Convert gpio_lock to raw spinlock (git-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur (git-fixes).\n- hwmon: (drivetemp) Set scsi command timeout to 10s (stable-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use \"proxy\" headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix division of negative numbers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- hyperv: Do not overlap the hvcall IO areas in get_vtl() (git-fixes).\n- i2c: core: fix reference leak in i2c_register_adapter() (git-fixes).\n- i2c: i801: Add support for Intel Arrow Lake-H (stable-fixes).\n- i2c: i801: Add support for Intel Panther Lake (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix \"ghost\" detections (git-fixes).\n- i2c: mux: demux-pinctrl: check initial mux selection, too (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: rcar: fix NACK handling when being a target (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (stable-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ibmvnic: Free any outstanding tx skbs during scrq reset (bsc#1226980).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() (git-fixes).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: adc: ad7124: Disable all channels at probe time (git-fixes).\n- iio: adc: ad_sigma_delta: Handle CS assertion as intended in ad_sd_read_reg_raw() (git-fixes).\n- iio: adc: at91: call input_free_device() on allocated iio_dev (git-fixes).\n- iio: adc: rockchip_saradc: fix information leak in triggered buffer (git-fixes).\n- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() (git-fixes).\n- iio: adc: ti-ads8688: fix information leak in triggered buffer (git-fixes).\n- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (git-fixes).\n- iio: gyro: fxas21002c: Fix missing data update in trigger handler (git-fixes).\n- iio: iio-mux: kzalloc instead of devm_kzalloc to ensure page alignment (git-fixes).\n- iio: imu: kmx61: fix information leak in triggered buffer (git-fixes).\n- iio: inkern: call iio_device_put() only on mapped devices (git-fixes).\n- iio: light: as73211: fix channel handling in only-color triggered buffer (git-fixes).\n- iio: light: vcnl4035: fix information leak in triggered buffer (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- iio: pressure: zpa2326: fix information leak in triggered buffer (git-fixes).\n- iio: test : check null return of kunit_kmalloc in iio_rescale_test_scale (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- intel_th: core: fix kernel-doc warnings (git-fixes).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- ipmi: ipmb: Add check devm_kasprintf() returned value (git-fixes).\n- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response (git-fixes).\n- irqchip/gic-v3: Force propagation of the active state with a read-back (stable-fixes).\n- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base (stable-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct auto_pin_cfg_item change (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- kheaders: Ignore silly-rename files (stable-fixes).\n- ktest.pl: Avoid false positives with grub2 skip regex (stable-fixes).\n- ktest.pl: Check kernelrelease return in get_version (git-fixes).\n- ktest.pl: Fix typo \"accesing\" (git-fixes).\n- ktest.pl: Fix typo in comment (git-fixes).\n- ktest.pl: Remove unused declarations in run_bisect_test function (git-fixes).\n- ktest: force $buildonly = 1 for 'make_warnings_file' test type (stable-fixes).\n- landlock: Handle weird files (git-fixes).\n- latencytop: use correct kernel-doc format for func params (git-fixes).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- leds: lp8860: Write full EEPROM, not only half of it (git-fixes).\n- leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata() (git-fixes).\n- lib/inflate.c: remove dead code (git-fixes).\n- lib/stackdepot: print disabled message only if truly disabled (git-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- mac802154: check local interfaces before deleting sdata list (stable-fixes).\n- mailbox: pcc: Add support for platform notification handling (stable-fixes).\n- mailbox: pcc: Support shared interrupt for multiple subspaces (stable-fixes).\n- mailbox: tegra-hsp: Clear mailbox before using message (git-fixes).\n- maple_tree: simplify split calculation (git-fixes).\n- media: camif-core: Add check for clk_enable() (git-fixes).\n- media: ccs: Clean up parsed CCS static data on parse failure (git-fixes).\n- media: ccs: Fix CCS static data parsing for large block sizes (git-fixes).\n- media: ccs: Fix cleanup order in ccs_probe() (git-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer (git-fixes).\n- media: i2c: imx412: Add missing newline to prints (git-fixes).\n- media: i2c: ov9282: Correct the exposure offset (git-fixes).\n- media: imx-jpeg: Fix potential error pointer dereference in detach_pm() (git-fixes).\n- media: imx296: Add standby delay during probe (git-fixes).\n- media: lmedm04: Handle errors for lme2510_int_read (git-fixes).\n- media: marvell: Add check for clk_enable() (git-fixes).\n- media: mc: fix endpoint iteration (git-fixes).\n- media: mipi-csis: Add check for clk_enable() (git-fixes).\n- media: nxp: imx8-isi: fix v4l2-compliance test errors (git-fixes).\n- media: ov5640: fix get_light_freq on auto (git-fixes).\n- media: rc: iguanair: handle timeouts (git-fixes).\n- media: rkisp1: Fix unused value issue (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: Fix crash during unbind if gpio unit is in use (git-fixes).\n- media: uvcvideo: Fix double free in error path (git-fixes).\n- media: uvcvideo: Fix event flags in uvc_ctrl_send_events (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4035 (stable-fixes).\n- media: uvcvideo: Only save async fh if success (git-fixes).\n- media: uvcvideo: Propagate buf-\u003eerror to userspace (git-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- media: uvcvideo: Remove dangling pointers (git-fixes).\n- media: uvcvideo: Remove redundant NULL assignment (git-fixes).\n- media: uvcvideo: Support partial control reads (git-fixes).\n- memory tiering: count PGPROMOTE_SUCCESS when mem tiering is enabled (git-fixes).\n- memory-failure: use a folio in me_huge_page() (git-fixes).\n- memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() (git-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- misc: fastrpc: Deregister device nodes properly in error scenarios (git-fixes).\n- misc: fastrpc: Fix copy buffer page size (git-fixes).\n- misc: fastrpc: Fix registered buffer page address (git-fixes).\n- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling (git-fixes).\n- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config (git-fixes).\n- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm,page_owner: do not remove __GFP_NOLOCKDEP in add_stack_record_to_list (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/memory-failure: cast index to loff_t before shifting it (git-fixes).\n- mm/memory-failure: check the mapcount of the precise page (git-fixes).\n- mm/memory-failure: fix crash in split_huge_page_to_list from soft_offline_page (git-fixes).\n- mm/memory-failure: pass the folio and the page to collect_procs() (git-fixes).\n- mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu (git-fixes).\n- mm/memory_hotplug: add missing mem_hotplug_lock (git-fixes).\n- mm/memory_hotplug: fix error handling in add_memory_resource() (git-fixes).\n- mm/memory_hotplug: prevent accessing by index=-1 (git-fixes).\n- mm/memory_hotplug: use pfn math in place of direct struct page manipulation (git-fixes).\n- mm/migrate: correct nr_failed in migrate_pages_sync() (git-fixes).\n- mm/migrate: fix deadlock in migrate_pages_batch() on large folios (git-fixes).\n- mm/migrate: putback split folios when numa hint migration fails (git-fixes).\n- mm/migrate: split source folio if it is on deferred split list (git-fixes).\n- mm/page_owner: remove free_ts from page_owner output (git-fixes).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mm/rodata_test: use READ_ONCE() to read const variable (git-fixes).\n- mm: convert DAX lock/unlock page to lock/unlock folio (git-fixes).\n- mm: memory-failure: ensure moving HWPoison flag to the raw error pages (git-fixes).\n- mm: memory-failure: fetch compound head after extra page refcnt is held (git-fixes).\n- mm: memory-failure: fix potential page refcnt leak in memory_failure() (git-fixes).\n- mm: memory-failure: fix race window when trying to get hugetlb folio (git-fixes).\n- mm: memory-failure: remove unneeded PageHuge() check (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- modpost: fix the missed iteration for the max bit in do_input() (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: onenand: Fix uninitialized retlen in do_otp_read() (git-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- mtd: spinand: Remove write_enable_op() in markbad() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting \"num_images\" to work (git-fixes).\n- net/rose: prevent integer overflows in rose_setsockopt() (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset (git-fixes).\n- net: rose: fix timer races against user threads (git-fixes).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- net: usb: qmi_wwan: add Telit FE910C04 compositions (stable-fixes).\n- net: usb: rtl8150: enable basic endpoint checking (git-fixes).\n- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() (git-fixes).\n- net: wwan: t7xx: Fix FSM command timeout issue (git-fixes).\n- netfilter: nf_tables: validate family when identifying table via handle (bsc#1233778 ZDI-24-1454).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix possible int overflows in nilfs_fiemap() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: Add error check for xa_store in nvme_get_effects_log (git-fixes).\n- nvme: Add error path for xa_store in nvme_init_effects (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix bogus kzalloc() return check in nvme_init_effects_log() (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- nvmet: propagate npwg topology (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- padata: add pd get/put refcnt helper (git-fixes).\n- padata: avoid UAF for reorder_work (git-fixes).\n- padata: fix UAF in padata_reorder (git-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: amd: Take suspend type into consideration which pins are non-wake (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails (git-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it (git-fixes).\n- platform/x86/intel-uncore-freq: Ignore minor version change (bsc#1225897).\n- platform/x86/intel/tpmi: Add defines to get version information (bsc#1225897).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- pm:cpupower: Add missing powercap_set_enabled() stub function (git-fixes).\n- power: ip5xxx_power: Fix return value on ADC read errors (git-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- powerpc/iommu: Move pSeries specific functions to pseries/iommu.c (bsc#1220711 ltc#205755).\n- powerpc/iommu: Only build sPAPR access functions on pSeries (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove MVE code (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove ioda1 support (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove last IODA1 defines (bsc#1220711 ltc#205755).\n- powerpc/pseries/eeh: Fix get PE state translation (bsc#1215199).\n- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).\n- powerpc/pseries/vas: Add close() callback in vas_vm_ops struct (bsc#1234825).\n- pps: add an error check in parport_attach (git-fixes).\n- pps: remove usage of the deprecated ida_simple_xx() API (stable-fixes).\n- printk: Add is_printk_legacy_deferred() (bsc#1236733).\n- printk: Defer legacy printing when holding printk_cpu_sync (bsc#1236733).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- pwm: stm32-lp: Add check for clk_enable() (git-fixes).\n- pwm: stm32: Add check for clk_enable() (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- rcu-tasks: Pull sampling of -\u003epercpu_dequeue_lim out of loop (git-fixes)\n- rcu/tree: Defer setting of jiffies during stall reset (git-fixes)\n- rcu: Dump memory object info if callback function is invalid (git-fixes)\n- rcu: Eliminate rcu_gp_slow_unregister() false positive (git-fixes)\n- rcuscale: Move rcu_scale_writer() (git-fixes)\n- rdma/cxgb4: Prevent potential integer overflow on 32bit (git-fixes)\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: core: Add missing newline character (git-fixes).\n- regulator: of: Implement the unwind path of of_regulator_match() (git-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- remoteproc: core: Fix ida_free call while not allocated (git-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (git-fixes).\n- rtc: zynqmp: Fix optional clock name property (git-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- s390x config: IOMMU_DEFAULT_DMA_LAZY=y (bsc#1235646)\n- samples/landlock: Fix possible NULL dereference in parse_path() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat (bsc#1235865).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat -kabi (bsc#1235865).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (git-fixes).\n- seccomp: Stub for !CONFIG_SECCOMP (stable-fixes).\n- selftest: media_tests: fix trivial UAF typo (git-fixes).\n- selftests/alsa: Fix circular dependency involving global-timer (stable-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- selftests/landlock: Fix error message (git-fixes).\n- selftests/mm/cow: modify the incorrect checking parameters (git-fixes).\n- selftests/powerpc: Fix argument order to timer_sub() (git-fixes).\n- selftests: harness: fix printing of mismatch values in __EXPECT() (git-fixes).\n- selftests: mptcp: avoid spurious errors on disconnect (git-fixes).\n- selftests: tc-testing: reduce rshift value (stable-fixes).\n- selftests: timers: clocksource-switch: Adapt progress to kselftest framework (git-fixes).\n- selinux: Fix SCTP error inconsistency in selinux_socket_bind() (git-fixes).\n- serial: 8250: Adjust the timeout for FIFO mode (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use (git-fixes).\n- serial: sh-sci: Drop __initdata macro for port_cfg (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: atmel: fix device_node release in atmel_soc_device_init() (git-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths (git-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: smem_state: fix missing of_node_put in error path (git-fixes).\n- soc: qcom: socinfo: Avoid out of bounds read of serial number (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- sound: usb: enable DSD output for ddHiFi TC44C (stable-fixes).\n- sound: usb: format: do not warn that raw DSD is unsupported (stable-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- spi: zynq-qspi: Add check for clk_enable() (git-fixes).\n- srcu: Fix srcu_struct node grpmask overflow on 64-bit systems (git-fixes)\n- srcu: Only accelerate on enqueue time (git-fixes)\n- stackdepot: rename pool_index to pool_index_plus_1 (git-fixes).\n- stackdepot: respect __GFP_NOLOCKDEP allocation flag (git-fixes).\n- staging: iio: ad9832: Correct phase range check (git-fixes).\n- staging: iio: ad9834: Correct phase range check (git-fixes).\n- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() (git-fixes).\n- staging: media: max96712: fix kernel oops when removing module (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- supported.conf: Add support for v4l2-dv-timings (jsc#PED-8645)\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- thermal: of: fix OF node leak in of_thermal_zone_find() (git-fixes).\n- thunderbolt: Add support for Intel Lunar Lake (stable-fixes).\n- thunderbolt: Add support for Intel Panther Lake-M/P (stable-fixes).\n- tipc: fix NULL deref in cleanup_bearer() (bsc#1235433).\n- tools: Sync if_xdp.h uapi tooling header (git-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm: Map the ACPI provided event log (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: 8250: Fix another runtime PM usage counter underflow (git-fixes).\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- ubifs: skip dumping tnc tree when zroot is null (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- uio: Fix return value of poll (git-fixes).\n- uio: uio_dmem_genirq: check the return value of devm_kasprintf() (git-fixes).\n- usb-storage: Add max sectors quirk for Nokia 208 (stable-fixes).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3-am62: Disable autosuspend during remove (git-fixes).\n- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk() (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: gadget: fix writing NYET threshold (git-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: fix reference leak in usb_new_device() (git-fixes).\n- usb: gadget: configfs: Ignore trailing LF for user strings to cdev (git-fixes).\n- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (git-fixes).\n- usb: gadget: f_tcm: Decrement command ref count on cleanup (git-fixes).\n- usb: gadget: f_tcm: Do not free command immediately (git-fixes).\n- usb: gadget: f_tcm: Do not prepare BOT write request twice (git-fixes).\n- usb: gadget: f_tcm: Fix Get/SetInterface return value (git-fixes).\n- usb: gadget: f_tcm: Translate error to sense (git-fixes).\n- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint (git-fixes).\n- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints (git-fixes).\n- usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: host: xhci-plat: Assign shared_hcd-\u003ersrc_start (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() (bsc#1235001)\n- usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() (git-fixes).\n- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- usbnet: ipheth: break up NCM header size computation (git-fixes).\n- usbnet: ipheth: check that DPE points past NCM header (git-fixes).\n- usbnet: ipheth: fix DPE OoB read (git-fixes).\n- usbnet: ipheth: fix possible overflow in DPE length check (git-fixes).\n- usbnet: ipheth: refactor NCM datagram loop (git-fixes).\n- usbnet: ipheth: use static NDP16 location in URB (git-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- vmscan,migrate: fix page count imbalance on node stats when demoting pages (git-fixes).\n- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler (stable-fixes).\n- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset (stable-fixes).\n- watchdog: rzg2l_wdt: Remove reset de-assert from probe (stable-fixes).\n- wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855 (git-fixes).\n- wifi: ath11k: cleanup struct ath11k_mon_data (git-fixes).\n- wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() (stable-fixes).\n- wifi: ath12k: fix tx power, max reg power update to firmware (git-fixes).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: brcmfmac: add missing header include for brcmf_dbg (git-fixes).\n- wifi: cfg80211: adjust allocation of colocated AP data (git-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: fw: read STEP table from correct UEFI var (git-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: Add non-atomic station iterator (stable-fixes).\n- wifi: mac80211: Fix common size calculation for ML element (git-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: do not flush non-uploaded STAs (git-fixes).\n- wifi: mac80211: export ieee80211_purge_tx_queue() for drivers (stable-fixes).\n- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: fix tid removal during mesh forwarding (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: mac80211: prohibit deactivating all links (git-fixes).\n- wifi: mac80211: wake the queues in case of failure in resume (stable-fixes).\n- wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO (git-fixes).\n- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC (git-fixes).\n- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 (git-fixes).\n- wifi: mt76: mt7915: firmware restart on devices with a second pcie link (git-fixes).\n- wifi: mt76: mt7915: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7915: fix register mapping (git-fixes).\n- wifi: mt76: mt7921: fix using incorrect group cipher after disconnection (git-fixes).\n- wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (git-fixes).\n- wifi: mt76: mt7996: add max mpdu len capability (git-fixes).\n- wifi: mt76: mt7996: fix HE Phy capability (git-fixes).\n- wifi: mt76: mt7996: fix definition of tx descriptor (git-fixes).\n- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event (git-fixes).\n- wifi: mt76: mt7996: fix ldpc setting (git-fixes).\n- wifi: mt76: mt7996: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7996: fix register mapping (git-fixes).\n- wifi: mt76: mt7996: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtlwifi: destroy workqueue at rtl_deinit_core (git-fixes).\n- wifi: rtlwifi: do not complete firmware loading needlessly (git-fixes).\n- wifi: rtlwifi: fix init_sw_vars leak when probe fails (git-fixes).\n- wifi: rtlwifi: fix memory leaks and invalid access at probe error path (git-fixes).\n- wifi: rtlwifi: pci: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtlwifi: remove unused check_buddy_priv (git-fixes).\n- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix media status report (git-fixes).\n- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop (git-fixes).\n- wifi: rtlwifi: usb: fix workqueue leak when probe fails (git-fixes).\n- wifi: rtlwifi: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- wifi: rtw89: mcc: consider time limits not divisible by 1024 (git-fixes).\n- wifi: wcn36xx: fix channel survey memory allocation size (git-fixes).\n- wifi: wlcore: fix unbalanced pm_runtime calls (git-fixes).\n- workqueue: Add rcu lock check at the end of work item execution (bsc#1236732).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0 (git-fixes).\n- xfs: Add error handling for xfs_reflink_cancel_cow_range (git-fixes).\n- xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-03-27T14:32:55Z","modified":"2026-03-23T04:48:13.571275Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20249-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).\n- CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).\n- CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).\n- CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).\n- CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).\n- CVE-2024-44996: vsock: fix recursive -\u003erecvmsg calls (bsc#1230205).\n- CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).\n- CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).\n- CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).\n- CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).\n- CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).\n- CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).\n- CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).\n- CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).\n- CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).\n- CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).\n- CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).\n- CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).\n- CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).\n- CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).\n- CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).\n- CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).\n- CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).\n- CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).\n- CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).\n- CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).\n- CVE-2024-53099: bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() (bsc#1233772).\n- CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).\n- CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).\n- CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).\n- CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).\n- CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).\n- CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).\n- CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).\n- CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).\n- CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).\n- CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).\n- CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)\n- CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).\n- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).\n- CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).\n- CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).\n- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).\n- CVE-2024-53170: block: fix uaf for flush rq while iterating tags (bsc#1234888).\n- CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).\n- CVE-2024-53175: ipc: fix memleak if msg_init_ns failed in create_ipc_ns (bsc#1234893).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey() (bsc#1234901).\n- CVE-2024-53187: io_uring: check for overflows in io_pin_pages (bsc#1234947).\n- CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use (bsc#1234957).\n- CVE-2024-53196: KVM: arm64: Do not retire aborted MMIO instruction (bsc#1234906).\n- CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).\n- CVE-2024-53203: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).\n- CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).\n- CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit() (bsc#1235011).\n- CVE-2024-53232: iommu/s390: Implement blocking domain (bsc#1235050).\n- CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).\n- CVE-2024-53236: xsk: Free skb when TX metadata options are invalid (bsc#1235000).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-53685: ceph: give up on paths longer than PATH_MAX (bsc#1235720).\n- CVE-2024-55639: net: renesas: rswitch: avoid use-after-put for a device tree node (bsc#1235737).\n- CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit() (bsc#1235745).\n- CVE-2024-56372: net: tun: fix tun_napi_alloc_frags() (bsc#1235753).\n- CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object-\u003efile (bsc#1234912).\n- CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).\n- CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).\n- CVE-2024-56569: ftrace: Fix regression with module command in stack_trace_filter (bsc#1235031).\n- CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).\n- CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235128).\n- CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization (bsc#1235123).\n- CVE-2024-56589: scsi: hisi_sas: Add cond_resched() for no forced preemption model (bsc#1235241).\n- CVE-2024-56599: wifi: ath10k: avoid NULL pointer error during sdio remove (bsc#1235138).\n- CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).\n- CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).\n- CVE-2024-56602: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (bsc#1235521).\n- CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create() (bsc#1235415).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56608: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487).\n- CVE-2024-56610: kcsan: Turn report_filterlist_lock into a raw_spinlock (bsc#1235390).\n- CVE-2024-56611: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (bsc#1235391).\n- CVE-2024-56614: xsk: fix OOB map writes when deleting elements (bsc#1235424).\n- CVE-2024-56615: bpf: fix OOB devmap writes when deleting elements (bsc#1235426).\n- CVE-2024-56617: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU (bsc#1235429).\n- CVE-2024-56620: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled (bsc#1235227).\n- CVE-2024-56622: scsi: ufs: core: sysfs: Prevent div by zero (bsc#1235251).\n- CVE-2024-56631: scsi: sg: Fix slab-use-after-free read in sg_release() (bsc#1235480).\n- CVE-2024-56635: net: avoid potential UAF in default_operstate() (bsc#1235519).\n- CVE-2024-56636: geneve: do not assume mac header is set in geneve_xmit_skb() (bsc#1235520).\n- CVE-2024-56637: netfilter: ipset: Hold module reference while requesting a module (bsc#1235523).\n- CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).\n- CVE-2024-56643: dccp: Fix memory leak in dccp_feat_change_recv (bsc#1235132).\n- CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fill_frame_info() (bsc#1235451).\n- CVE-2024-56649: net: enetc: Do not configure preemptible TCs if SIs do not support (bsc#1235449).\n- CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430).\n- CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips (bsc#1235444).\n- CVE-2024-56659: net: lapb: increase LAPB_HEADER_LEN (bsc#1235439).\n- CVE-2024-56660: net/mlx5: DR, prevent potential error pointer dereference (bsc#1235437).\n- CVE-2024-56664: bpf, sockmap: Fix race between element replace and close() (bsc#1235249).\n- CVE-2024-56665: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog (bsc#1235489).\n- CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (bsc#1235555).\n- CVE-2024-56679: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (bsc#1235498).\n- CVE-2024-56693: brd: defer automatic disk creation until module initialization succeeds (bsc#1235418).\n- CVE-2024-56694: bpf: fix recursive lock when verdict program return SK_PASS (bsc#1235412).\n- CVE-2024-56704: 9p/xen: fix release of IRQ (bsc#1235584).\n- CVE-2024-56707: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (bsc#1235545).\n- CVE-2024-56708: EDAC/igen6: Avoid segmentation fault on module unload (bsc#1235564).\n- CVE-2024-56712: udmabuf: fix memory leak on last export_udmabuf() error path (bsc#1235565).\n- CVE-2024-56715: ionic: Fix netdev notifier unregister on failure (bsc#1235612).\n- CVE-2024-56716: netdevsim: prevent bad user input in nsim_dev_health_break_write() (bsc#1235587).\n- CVE-2024-56725: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c (bsc#1235578).\n- CVE-2024-56726: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c (bsc#1235582).\n- CVE-2024-56727: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (bsc#1235583).\n- CVE-2024-56728: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (bsc#1235656).\n- CVE-2024-56729: smb: Initialize cfid-\u003etcon before performing network ops (bsc#1235503).\n- CVE-2024-56747: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (bsc#1234934).\n- CVE-2024-56748: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (bsc#1235627).\n- CVE-2024-56755: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (bsc#1234920).\n- CVE-2024-56759: btrfs: fix use-after-free when COWing tree bock and tracing is enabled (bsc#1235645).\n- CVE-2024-56763: tracing: Prevent bad count for tracing_cpumask_write (bsc#1235638).\n- CVE-2024-56774: btrfs: add a sanity check for btrfs root in btrfs_search_slot() (bsc#1235653).\n- CVE-2024-56775: drm/amd/display: Fix handling of plane refcount (bsc#1235657).\n- CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data (bsc#1235759).\n- CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235768).\n- CVE-2024-57795: RDMA/rxe: Remove the direct link to net_device (bsc#1235906).\n- CVE-2024-57801: net/mlx5e: Skip restore TC rules for vport rep without loaded flag (bsc#1235940).\n- CVE-2024-57802: netrom: check buffer length before accessing it (bsc#1235941).\n- CVE-2024-57804: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (bsc#1235779).\n- CVE-2024-57809: PCI: imx6: Fix suspend/resume support on i.MX6QDL (bsc#1235793).\n- CVE-2024-57838: s390/entry: Mark IRQ entries to fix stack depot warnings (bsc#1235798).\n- CVE-2024-57857: RDMA/siw: Remove direct link to net_device (bsc#1235946).\n- CVE-2024-57884: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (bsc#1235948).\n- CVE-2024-57892: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (bsc#1235964).\n- CVE-2024-57896: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (bsc#1235965).\n- CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets (bsc#1235967).\n- CVE-2024-57917: topology: Keep the cpumask unchanged when printing cpumap (bsc#1236127).\n- CVE-2024-57929: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (bsc#1236096).\n- CVE-2024-57931: selinux: ignore unknown extended permissions (bsc#1236192).\n- CVE-2024-57932: gve: guard XDP xmit NDO on existence of xdp queues (bsc#1236190).\n- CVE-2024-57933: gve: guard XSK operations on the existence of queues (bsc#1236178).\n- CVE-2024-57938: net/sctp: Prevent autoclose integer overflow in sctp_association_init() (bsc#1236182).\n- CVE-2024-57946: virtio-blk: do not keep queue frozen during system suspend (bsc#1236247).\n- CVE-2025-21632: x86/fpu: Ensure shadow stack is active before \"getting\" registers (bsc#1236106).\n- CVE-2025-21649: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (bsc#1236143).\n- CVE-2025-21650: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue (bsc#1236144).\n- CVE-2025-21651: net: hns3: do not auto enable misc vector (bsc#1236145).\n- CVE-2025-21652: ipvlan: Fix use-after-free in ipvlan_get_iflink() (bsc#1236160).\n- CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (bsc#1236161).\n- CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (bsc#1236163).\n- CVE-2025-21662: net/mlx5: Fix variable not being completed when function returns (bsc#1236198).\n- CVE-2025-21663: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (bsc#1236260).\n- CVE-2025-21664: dm thin: make get_first_thin use rcu-safe list first function (bsc#1236262).\n- CVE-2025-21674: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (bsc#1236688).\n- CVE-2025-21676: net: fec: handle page_pool_dev_alloc_pages error (bsc#1236696).\n- CVE-2025-21682: eth: bnxt: always recalculate features after XDP clearing, fix null-deref (bsc#1236703).\n\nFeatures added:\n\n  * - Disable ceph (jsc#PED-7242)\n  * - RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n  * - ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n  * - supported.conf: Add support for v4l2-dv-timings  (jsc#PED-8645)\n\n\nThe following non-security bugs were fixed:\n\n- 9p: v9fs_fid_find: also lookup by inode if not found dentry (git-fixes).\n- ACPI/HMAT: Move HMAT messages to pr_debug() (bsc#1234294)\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A (stable-fixes).\n- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 (stable-fixes).\n- ACPI: PCC: Add PCC shared memory region command and status bitfields (stable-fixes).\n- ACPI: PRM: Add PRM handler direct call support (jsc#PED-10467).\n- ACPI: fan: cleanup resources in the error path of .probe() (git-fixes).\n- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] (stable-fixes).\n- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] (stable-fixes).\n- ACPI: resource: Fix memory resource type union access (git-fixes).\n- ACPI: resource: acpi_dev_irq_override(): Check DMI match last (stable-fixes).\n- ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840 (stable-fixes).\n- ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[] (stable-fixes).\n- ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID (stable-fixes).\n- ACPICA: events/evxfregn: do not release the ContextMutex that was never acquired (git-fixes).\n- ALSA hda/realtek: Add quirk for Framework F111:000C (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio (stable-fixes).\n- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop (git-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model (stable-fixes).\n- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA (stable-fixes).\n- ALSA: hda/realtek: Add support for Galaxy Book2 Pro (NP950XEE) (stable-fixes).\n- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx (stable-fixes).\n- ALSA: hda/realtek: Enable headset mic on Positivo C6400 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 (stable-fixes).\n- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (bsc#1235686).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Fix headset detection failure due to unstable sort (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Check UMP support for midi_version change (git-fixes).\n- ALSA: seq: oss: Fix races at processing SysEx messages (stable-fixes).\n- ALSA: seq: ump: Fix seq port updates per FB info notify (git-fixes).\n- ALSA: seq: ump: Use automatic cleanup of kfree() (stable-fixes).\n- ALSA: seq: ump: Use guard() for locking (stable-fixes).\n- ALSA: ump: Use guard() for locking (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for USB Audio Device (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro (stable-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 (stable-fixes).\n- ALSA: usb-audio: Notify xrun for low-latency mode (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: US16x08: Initialize array before use (git-fixes).\n- ASoC: Intel: avs: Fix theoretical infinite loop (git-fixes).\n- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C (stable-fixes).\n- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: acp: Support microphone from Lenovo Go S (stable-fixes).\n- ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 (stable-fixes).\n- ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW (stable-fixes).\n- ASoC: amd: yc: Fix the wrong return value (git-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: fix internal mic on Redmi G 2022 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: hdmi-codec: reorder channel allocation list (stable-fixes).\n- ASoC: mediatek: disable buffer pre-allocation (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback (git-fixes).\n- ASoC: rt722: add delay time to wait for the calibration procedure (stable-fixes).\n- ASoC: samsung: Add missing depends on I2C (git-fixes).\n- ASoC: samsung: Add missing selects for MFD_WM8994 (stable-fixes).\n- ASoC: sun4i-spdif: Add clock multiplier settings (git-fixes).\n- ASoC: wm8994: Add depends on MFD core (stable-fixes).\n- Add already cherry-picked ids to AMDGPU patch\n- Align git commit ID abbreviation guidelines and checks (git-fixes).\n- Bluetooth: Add support ITTIM PE50-M75C (stable-fixes).\n- Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (stable-fixes).\n- Bluetooth: ISO: Reassociate a socket with an active BIS (stable-fixes).\n- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection (git-fixes).\n- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (stable-fixes).\n- Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (git-fixes).\n- Bluetooth: MGMT: Fix Add Device to responding before completing (git-fixes).\n- Bluetooth: MGMT: Fix possible deadlocks (git-fixes).\n- Bluetooth: SCO: Add support for 16 bits transparent voice setting (git-fixes).\n- Bluetooth: btnxpuart: Fix driver sending truncated data (git-fixes).\n- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming (git-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (stable-fixes).\n- Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 (stable-fixes).\n- Bluetooth: btusb: add callback function in btusb suspend/resume (stable-fixes).\n- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect (stable-fixes).\n- Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (stable-fixes).\n- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (git-fixes).\n- Bluetooth: hci_sync: Fix not setting Random Address when required (git-fixes).\n- Bluetooth: iso: Fix recursive locking warning (git-fixes).\n- Delete XHCI patch for regression (bsc#1235550)\n- Disable ceph (jsc#PED-7242)\n- Documentation: PM: Clarify pm_runtime_resume_and_get() return value (git-fixes).\n- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (git-fixes).\n- Drop downstream TPM fix patch (bsc#1233260 bsc#1233259 bsc#1232421)\n- Drop uvcvideo fix due to regression (bsc#1235894)\n- EDAC/{i10nm,skx,skx_common}: Support UV systems (bsc#1234693).\n- HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (git-fixes).\n- HID: fix generic desktop D-Pad controls (git-fixes).\n- HID: hid-sensor-hub: do not use stale platform-data on remove (git-fixes).\n- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (git-fixes).\n- HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support (stable-fixes).\n- HID: multitouch: fix support for Goodix PID 0x01e9 (git-fixes).\n- Input: atkbd - map F23 key to support default copilot shortcut (stable-fixes).\n- Input: bbnsm_pwrkey - add remove hook (git-fixes).\n- Input: bbnsm_pwrkey - fix missed key press after suspend (git-fixes).\n- Input: davinci-keyscan - remove leftover header (git-fixes).\n- Input: xpad - add QH Electronics VID/PID (stable-fixes).\n- Input: xpad - add support for Nacon Evol-X Xbox One Controller (stable-fixes).\n- Input: xpad - add support for Nacon Pro Compact (stable-fixes).\n- Input: xpad - add support for wooting two he (arm) (stable-fixes).\n- Input: xpad - add unofficial Xbox 360 wireless receiver clone (stable-fixes).\n- Input: xpad - improve name of 8BitDo controller 2dc8:3106 (stable-fixes).\n- KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits (bsc#1234635).\n- KVM: s390: Reject KVM_SET_GSI_ROUTING on ucontrol VMs (git-fixes bsc#1235776).\n- KVM: s390: Reject setting flic pfault attributes on ucontrol VMs (git-fixes bsc#1235777).\n- KVM: s390: vsie: fix virtual/physical address in unpin_scb() (git-fixes bsc#1235778).\n- Move kABI workaround patch to correct folder\n- Move upstreamed DRM patch into sorted section\n- Move upstreamed NFS patch into sorted section\n- Move upstreamed TPM patch into sorted section\n- Move upstreamed lpfc patches into sorted section\n- Move upstreamed ppc patch into sorted section\n- Move upstreamed sound patch into sorted section\n- Move upstreamed sound patches into sorted section\n- NFC: nci: Add bounds checking in nci_hci_create_pipe() (git-fixes).\n- NFS/pnfs: Fix a live lock between recalled layouts and layoutget (git-fixes).\n- NFSD: Async COPY result needs to return a write verifier (git-fixes).\n- NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() (git-fixes).\n- NFSD: Fix nfsd4_shutdown_copy() (git-fixes).\n- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (git-fixes).\n- NFSD: Prevent a potential integer overflow (git-fixes).\n- NFSD: Remove a never-true comparison (git-fixes).\n- NFSD: initialize copy-\u003ecp_clp early in nfsd4_copy for use by trace point (git-fixes).\n- NFSv4.0: Fix a use-after-free problem in the asynchronous open() (git-fixes).\n- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation (git-fixes).\n- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE (git-fixes).\n- Octeontx2-pf: Free send queue buffers incase of leaf to inner (git-fixes).\n- PCI/AER: Disable AER service on suspend (stable-fixes).\n- PCI/MSI: Handle lack of irqdomain gracefully (git-fixes).\n- PCI: Add 'reset_subordinate' to reset hierarchy below bridge (stable-fixes).\n- PCI: Add ACS quirk for Broadcom BCM5760X NIC (stable-fixes).\n- PCI: Add ACS quirk for Wangxun FF5xxx NICs (stable-fixes).\n- PCI: Add T_PERST_CLK_US macro (git-fixes).\n- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (git-fixes).\n- PCI: Detect and trust built-in Thunderbolt chips (stable-fixes).\n- PCI: Fix use-after-free of slot-\u003ebus on hot remove (stable-fixes).\n- PCI: Use preserve_config in place of pci_flags (stable-fixes).\n- PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() (stable-fixes).\n- PCI: cadence: Set cdns_pcie_host_init() global (stable-fixes).\n- PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads (stable-fixes).\n- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq (git-fixes).\n- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (git-fixes).\n- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() (git-fixes).\n- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() (git-fixes).\n- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() (git-fixes).\n- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test (git-fixes).\n- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error (git-fixes).\n- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset() (git-fixes).\n- PCI: imx6: Skip controller_id generation logic for i.MX7D (git-fixes).\n- PCI: j721e: Add PCIe 4x lane selection support (stable-fixes).\n- PCI: j721e: Add per platform maximum lane settings (stable-fixes).\n- PCI: j721e: Add reset GPIO to struct j721e_pcie (stable-fixes).\n- PCI: j721e: Add suspend and resume support (git-fixes).\n- PCI: j721e: Use T_PERST_CLK_US macro (git-fixes).\n- PCI: microchip: Set inbound address translation for coherent or non-coherent mode (git-fixes).\n- PCI: qcom: Add support for IPQ9574 (stable-fixes).\n- PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() (git-fixes).\n- PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs (stable-fixes).\n- PCI: vmd: Set devices to D0 before enabling PM L1 Substates (stable-fixes).\n- PM: hibernate: Add error handling for syscore_suspend() (git-fixes).\n- RAS/AMD/ATL: Translate normalized to system physical addresses using PRM (jsc#PED-10467).\n- RDMA/bnxt_re: Add check for path mtu in modify_qp (git-fixes)\n- RDMA/bnxt_re: Add send queue size check for variable wqe (git-fixes)\n- RDMA/bnxt_re: Avoid initializing the software queue for user queues (git-fixes)\n- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters (git-fixes)\n- RDMA/bnxt_re: Disable use of reserved wqes (git-fixes)\n- RDMA/bnxt_re: Fix MSN table size for variable wqe mode (git-fixes)\n- RDMA/bnxt_re: Fix max SGEs for the Work Request (git-fixes)\n- RDMA/bnxt_re: Fix max_qp_wrs reported (git-fixes)\n- RDMA/bnxt_re: Fix reporting hw_ver in query_device (git-fixes)\n- RDMA/bnxt_re: Fix the check for 9060 condition (git-fixes)\n- RDMA/bnxt_re: Fix the locking while accessing the QP table (git-fixes)\n- RDMA/bnxt_re: Fix the max WQE size for static WQE support (git-fixes)\n- RDMA/bnxt_re: Fix the max WQEs used in Static WQE mode (git-fixes)\n- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error (git-fixes)\n- RDMA/bnxt_re: Fix to export port num to ib_query_qp (git-fixes)\n- RDMA/bnxt_re: Remove always true dattr validity check (git-fixes)\n- RDMA/core: Fix ENODEV error for iWARP test over vlan (git-fixes)\n- RDMA/hns: Fix accessing invalid dip_ctx during destroying QP (git-fixes)\n- RDMA/hns: Fix mapping error of zero-hop WQE buffer (git-fixes)\n- RDMA/hns: Fix missing flush CQE for DWQE (git-fixes)\n- RDMA/hns: Fix warning storm caused by invalid input in IO path (git-fixes)\n- RDMA/mlx4: Avoid false error about access to uninitialized gids array (git-fixes)\n- RDMA/mlx5: Enforce same type port association for multiport RoCE (git-fixes)\n- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (git-fixes)\n- RDMA/mlx5: Fix implicit ODP use after free (git-fixes)\n- RDMA/mlx5: Fix indirect mkey ODP page count (git-fixes)\n- RDMA/rtrs: Ensure 'ib_sge list' is accessible (git-fixes)\n- RDMA/rxe: Fix mismatched max_msg_sz (git-fixes)\n- RDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\" (git-fixes)\n- RDMA/srp: Fix error handling in srp_add_port (git-fixes)\n- RDMA/uverbs: Prevent integer overflow issue (git-fixes)\n- README.BRANCH: Remove copy of branch name\n- Refresh patches.suse/ALSA-hda-realtek-Add-support-for-Samsung-Galaxy-Book.patch.\n- Refresh patches.suse/cpufreq-intel_pstate-Temporarily-boost-P-state-when-.patch.\n- Revert \"HID: multitouch: Add support for lenovo Y9000P Touchpad\" (stable-fixes).\n- Revert \"block/mq-deadline: use correct way to throttling write requests\" (bsc#1234146).\n- Revert \"btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\"\n- Revert \"drm/i915/dpt: Make DPT object unshrinkable\" (stable-fixes).\n- Revert \"igb: Disable threaded IRQ for igb_msix_other\" (git-fixes).\n- Revert \"mtd: spi-nor: core: replace dummy buswidth from addr to data\" (git-fixes).\n- Revert \"unicode: Do not special case ignorable code points\" (stable-fixes).\n- Revert \"usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null\" (stable-fixes).\n- Revert 'arm64: Kconfig: Make SME depend on BROKEN for now' This reverts commit 2ccfee6be929dd4ea49ef59a7ae686473aae40b6 CONFIG_ARM64_SME is enabled by default so some customers may rely on SME. We need further analysis to evaluate to what extent we are impacted and in case we'll disable SME support later.\n- Revert 0dd78566990 (\"Disable ceph (jsc#PED-7242)\") Apparently, jsc#PED-7242 is only deprecate ceph for 15-SP6 and disable for 15-SP7. Revert the disabling.\n- SUNRPC: make sure cache entry active before cache_show (git-fixes).\n- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (git-fixes).\n- USB: core: Disable LPM only for non-suspended ports (git-fixes).\n- USB: serial: cp210x: add Phoenix Contact UPS Device (stable-fixes).\n- USB: serial: option: add MediaTek T7XX compositions (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM770A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM815 (stable-fixes).\n- USB: serial: option: add Neoway N723-EA support (stable-fixes).\n- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready (stable-fixes).\n- USB: serial: option: add TCL IK512 MBIM \u0026 ECM (stable-fixes).\n- USB: serial: option: add Telit FE910C04 rmnet compositions (stable-fixes).\n- USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (git-fixes).\n- USB: usblp: return error when setting unsupported protocol (git-fixes).\n- VFS: use system_unbound_wq for delayed_mntput (bsc#1234683).\n- VMCI: fix reference to ioctl-number.rst (git-fixes).\n- accel/habanalabs/gaudi2: unsecure tpc count registers (stable-fixes).\n- accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE (stable-fixes).\n- accel/habanalabs: fix debugfs files permissions (stable-fixes).\n- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings (stable-fixes).\n- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (git-fixes).\n- af_unix: Call manage_oob() for every skb in unix_stream_read_generic() (bsc#1234725).\n- afs: Automatically generate trace tag enums (git-fixes).\n- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY (git-fixes).\n- afs: Fix cleanup of immediately failed async calls (git-fixes).\n- afs: Fix directory format encoding struct (git-fixes).\n- afs: Fix missing subdir edit when renamed between parent dirs (git-fixes).\n- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call (git-fixes).\n- afs: Fix the maximum cell name length (git-fixes).\n- amdgpu/uvd: get ring reference from rq scheduler (git-fixes).\n- arch: Introduce arch_{,try_}_cmpxchg128{,_local}() (bsc#1220773).\n- arch: Remove cmpxchg_double (bsc#1220773).\n- arch: consolidate arch_irq_work_raise prototypes (git-fixes).\n- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() (git-fixes)\n- arm64: Ensure bits ASID[15:8] are masked out when the kernel uses (bsc#1234605)\n- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented (git-fixes)\n- arm64: Force position-independent veneers (git-fixes).\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes bsc#1236245) Update arm64 default configuration file\n- arm64: Kconfig: Make SME depend on BROKEN for now (git-fixes).\n- arm64: dts: imx8mp: correct sdhc ipg clk (git-fixes).\n- arm64: dts: rockchip: Add sdmmc/sdio/emmc reset controls for RK3328 (git-fixes)\n- arm64: dts: rockchip: add hevc power domain clock to rk3328 (git-fixes).\n- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma (git-fixes)\n- arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL (git-fixes).\n- arm64: tegra: Disable Tegra234 sce-fabric node (git-fixes)\n- arm64: tegra: Fix Tegra234 PCIe interrupt-map (git-fixes)\n- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible (git-fixes)\n- ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() (stable-fixes).\n- autofs: fix memory leak of waitqueues in autofs_catatonic_mode (git-fixes).\n- batman-adv: Do not let TT changes list grows indefinitely (git-fixes).\n- batman-adv: Do not send uninitialized TT changes (git-fixes).\n- batman-adv: Remove uninitialized data in full table TT response (git-fixes).\n- blacklist.conf: printk/sysctl: breaks kernel without pre-requisite patches (bsc#1229025)\n- blk-cgroup: Fix UAF in blkcg_unpin_online() (bsc#1234726).\n- blk-core: use pr_warn_ratelimited() in bio_check_ro() (bsc#1234139).\n- blk-iocost: Fix an UBSAN shift-out-of-bounds warning (bsc#1234144).\n- blk-iocost: do not WARN if iocg was already offlined (bsc#1234147).\n- blk-throttle: fix lockdep warning of \"cgroup_mutex or RCU read lock required!\" (bsc#1234140).\n- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (bsc#1234149).\n- block, bfq: do not break merge chain in bfq_split_bfqq() (bsc#1234150).\n- block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234160).\n- block, bfq: fix procress reference leakage for bfqq in merge chain (bsc#1234280).\n- block, bfq: fix uaf for accessing waker_bfqq after splitting (bsc#1234279).\n- block/mq-deadline: Fix the tag reservation code (bsc#1234148).\n- block: Call .limit_depth() after .hctx has been set (bsc#1234148).\n- block: Fix where bio IO priority gets set (bsc#1234145).\n- block: prevent an integer overflow in bvec_try_merge_hw_page (bsc#1234142).\n- block: update the stable_writes flag in bdev_add (bsc#1234141).\n- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (git-fixes)\n- bnxt_en: Fix receive ring space parameters when XDP is active (git-fixes).\n- bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down (git-fixes).\n- bnxt_en: Set backplane link modes correctly for ethtool (git-fixes).\n- bpf, x86: Fix PROBE_MEM runtime load check (git-fixes).\n- bpf: verifier: prevent userspace memory access (git-fixes).\n- btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235445).\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235128)\n- btrfs: fix use-after-free waiting for encoded read endios (bsc#1235445).\n- bus: mhi: host: Free mhi_buf vector inside mhi_alloc_bhie_table() (git-fixes).\n- can: gs_usb: add VID/PID for Xylanta SAINT3 product family (stable-fixes).\n- can: j1939: fix error in J1939 documentation (stable-fixes).\n- ceph: improve error handling and short/overflow-read logic in __ceph_sync_read() (bsc#1228592).\n- checkpatch: always parse orig_commit in fixes tag (git-fixes).\n- checkpatch: check for missing Fixes tags (stable-fixes).\n- cleanup: Add conditional guard support (stable-fixes).\n- cleanup: Adjust scoped_guard() macros to avoid potential warning (stable-fixes).\n- cleanup: Remove address space of returned pointer (git-fixes).\n- clocksource/drivers/timer-ti-dm: Fix child node refcount handling (git-fixes).\n- clocksource/drivers:sp804: Make user selectable (git-fixes).\n- counter: stm32-timer-cnt: Add check for clk_enable() (git-fixes).\n- counter: ti-ecap-capture: Add check for clk_enable() (git-fixes).\n- cpufreq: ACPI: Fix max-frequency computation (git-fixes).\n- cpufreq: Do not unregister cpufreq cooling on CPU hotplug (git-fixes).\n- cpufreq: amd-pstate: remove global header file (git-fixes).\n- cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization (bsc#1234619).\n- cpufreq: intel_pstate: Drop redundant locking from intel_pstate_driver_cleanup() (bsc#1234619).\n- cpufreq: intel_pstate: Fix unchecked HWP MSR access (bsc#1234619).\n- cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller (bsc#1234619).\n- cpufreq: intel_pstate: Get rid of unnecessary READ_ONCE() annotations (bsc#1234619).\n- cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock (git-fixes).\n- cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE() (bsc#1234619).\n- cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo() (bsc#1234619).\n- cpufreq: intel_pstate: Refine computation of P-state for given frequency (bsc#1234619).\n- cpufreq: intel_pstate: Replace three global.turbo_disabled checks (bsc#1234619).\n- cpufreq: intel_pstate: Revise global turbo disable check (bsc#1234619).\n- cpufreq: intel_pstate: Simplify spinlock locking (bsc#1234619).\n- cpufreq: intel_pstate: Update the maximum CPU frequency consistently (bsc#1234619).\n- cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing (git-fixes).\n- cpufreq: intel_pstate: Use __ro_after_init for three variables (bsc#1234619).\n- cpufreq: intel_pstate: Wait for canceled delayed work to complete (bsc#1234619).\n- cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back (git-fixes).\n- cpuidle: Avoid potential overflow in integer multiplication (git-fixes).\n- cpupower: fix TSC MHz calculation (git-fixes).\n- crypto: caam - use JobR's space to access page 0 regs (git-fixes).\n- crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes (git-fixes).\n- crypto: ecdsa - Avoid signed integer overflow on signature decoding (stable-fixes).\n- crypto: ecdsa - Convert byte arrays with key coordinates to digits (stable-fixes).\n- crypto: ecdsa - Rename keylen to bufsize where necessary (stable-fixes).\n- crypto: ecdsa - Use ecc_digits_from_bytes to convert signature (stable-fixes).\n- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async' (git-fixes).\n- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() (git-fixes).\n- crypto: qat - disable IOV in adf_dev_stop() (git-fixes).\n- crypto: qce - fix goto jump in error path (git-fixes).\n- crypto: qce - fix priority to be less than ARMv8 CE (git-fixes).\n- crypto: qce - unregister previously registered algos in error path (git-fixes).\n- crypto: x86/sha256 - Add parentheses around macros' single arguments (stable-fixes).\n- cyrpto/b128ops: Remove struct u128 (bsc#1220773).\n- devcoredump: cleanup some comments (git-fixes).\n- devlink: Fix length of eswitch inline-mode (git-fixes).\n- dlm: fix possible lkb_resource null dereference (git-fixes).\n- dma-buf: fix dma_fence_array_signaled v4 (stable-fixes).\n- dma-debug: fix a possible deadlock on radix_lock (stable-fixes).\n- dmaengine: apple-admac: Avoid accessing registers in probe (git-fixes).\n- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (git-fixes).\n- dmaengine: dw: Select only supported masters for ACPI devices (git-fixes).\n- dmaengine: idxd: Check for driver name match before sva user feature (bsc#1234357).\n- dmaengine: mv_xor: fix child node refcount handling in early exit (git-fixes).\n- dmaengine: tegra: Return correct DMA status when paused (git-fixes).\n- dmaengine: ti: edma: fix OF node reference leaks in edma_driver (git-fixes).\n- docs: media: update location of the media patches (stable-fixes).\n- docs: power: Fix footnote reference for Toshiba Satellite P10-554 (git-fixes).\n- driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link (stable-fixes).\n- driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() (git-fixes).\n- driver core: fw_devlink: Improve logs for cycle detection (stable-fixes).\n- driver core: fw_devlink: Stop trying to optimize cycle detection logic (git-fixes).\n- drivers/card_reader/rtsx_usb: Restore interrupt based detection (git-fixes).\n- drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path (git-fixes).\n- drm/amd/display: Add HDR workaround for specific eDP (stable-fixes).\n- drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (stable-fixes).\n- drm/amd/display: Add check for granularity in dml ceil/floor helpers (stable-fixes).\n- drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` (stable-fixes).\n- drm/amd/display: Avoid overflow assignment in link_dp_cts (stable-fixes).\n- drm/amd/display: Fix DSC-re-computing (stable-fixes).\n- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (stable-fixes).\n- drm/amd/display: Fix incorrect DSC recompute trigger (stable-fixes).\n- drm/amd/display: Revert Avoid overflow assignment (stable-fixes).\n- drm/amd/display: Use HW lock mgr for PSR1 (stable-fixes).\n- drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces (stable-fixes).\n- drm/amd/display: increase MAX_SURFACES to the value supported by hw (stable-fixes).\n- drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config() (git-fixes).\n- drm/amd/pm: fix the high voltage issue after unload (stable-fixes).\n- drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 (stable-fixes).\n- drm/amdgpu/gfx10: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx11: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/gfx9: properly handle error ints on all pipes (stable-fixes).\n- drm/amdgpu/gfx9: use rlc safe mode for soft recovery (stable-fixes).\n- drm/amdgpu/hdp5.2: do a posting read when flushing HDP (stable-fixes).\n- drm/amdgpu/pm: Remove gpu_od if it's an empty directory (stable-fixes).\n- drm/amdgpu/umsch: do not execute umsch test when GPU is in reset/suspend (stable-fixes).\n- drm/amdgpu/umsch: reinitialize write pointer in hw init (stable-fixes).\n- drm/amdgpu/vcn: reset fw_shared under SRIOV (git-fixes).\n- drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3 (stable-fixes).\n- drm/amdgpu: Block MMR_READ IOCTL in reset (stable-fixes).\n- drm/amdgpu: Dereference the ATCS ACPI buffer (stable-fixes).\n- drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table (git-fixes).\n- drm/amdgpu: add raven1 gfxoff quirk (stable-fixes).\n- drm/amdgpu: add smu 14.0.1 discovery support (stable-fixes).\n- drm/amdgpu: always sync the GFX pipe on ctx switch (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih (stable-fixes).\n- drm/amdgpu: differentiate external rev id for gfx 11.5.0 (stable-fixes).\n- drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit (stable-fixes).\n- drm/amdgpu: do not access invalid sched (git-fixes).\n- drm/amdgpu: enable gfxoff quirk on HP 705G4 (stable-fixes).\n- drm/amdgpu: fix unchecked return value warning for amdgpu_gfx (stable-fixes).\n- drm/amdgpu: fix usage slab after free (stable-fixes).\n- drm/amdgpu: prevent BO_HANDLES error from being overwritten (git-fixes).\n- drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr (stable-fixes).\n- drm/amdgpu: set the right AMDGPU sg segment limitation (stable-fixes).\n- drm/amdgpu: simplify return statement in amdgpu_ras_eeprom_init (git-fixes).\n- drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov (stable-fixes).\n- drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini() (git-fixes).\n- drm/amdkfd: Correct the migration DMA map direction (stable-fixes).\n- drm/amdkfd: Fix resource leak in criu restore queue (stable-fixes).\n- drm/amdkfd: Use device based logging for errors (stable-fixes).\n- drm/amdkfd: Use the correct wptr size (stable-fixes).\n- drm/amdkfd: fixed page fault when enable MES shader debugger (git-fixes).\n- drm/amdkfd: pause autosuspend when creating pdd (stable-fixes).\n- drm/bridge: adv7511_audio: Update Audio InfoFrame properly (git-fixes).\n- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE (git-fixes).\n- drm/bridge: it6505: Enable module autoloading (stable-fixes).\n- drm/bridge: it6505: Fix inverted reset polarity (git-fixes).\n- drm/bridge: it6505: update usleep_range for RC circuit charge time (stable-fixes).\n- drm/display: Fix building with GCC 15 (stable-fixes).\n- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (stable-fixes).\n- drm/dp_mst: Fix MST sideband message body length check (stable-fixes).\n- drm/dp_mst: Fix resetting msg rx state after topology removal (git-fixes).\n- drm/dp_mst: Verify request type in the corresponding down message reply (stable-fixes).\n- drm/etnaviv: Fix page property being used for non writecombine buffers (git-fixes).\n- drm/etnaviv: flush shader L1 cache after user commandstream (stable-fixes).\n- drm/i915/dg1: Fix power gate sequence (git-fixes).\n- drm/i915/fb: Relax clear color alignment to 64 bytes (stable-fixes).\n- drm/i915: Fix NULL pointer dereference in capture_engine (git-fixes).\n- drm/i915: Fix memory leak by correcting cache object name in error handler (git-fixes).\n- drm/mcde: Enable module autoloading (stable-fixes).\n- drm/mediatek: Add return value check when reading DPCD (git-fixes).\n- drm/mediatek: Add support for 180-degree rotation in the display driver (git-fixes).\n- drm/mediatek: Fix YCbCr422 color format issue for DP (git-fixes).\n- drm/mediatek: Fix mode valid issue for dp (git-fixes).\n- drm/mediatek: Set private-\u003eall_drm_private[i]-\u003edrm to NULL if mtk_drm_bind returns err (git-fixes).\n- drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188 (git-fixes).\n- drm/mediatek: stop selecting foreign drivers (git-fixes).\n- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (stable-fixes).\n- drm/msm/dp: set safe_to_exit_level before printing it (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350 (git-fixes).\n- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550 (git-fixes).\n- drm/msm: Check return value of of_dma_configure() (git-fixes).\n- drm/msm: do not clean up priv-\u003ekms prematurely (git-fixes).\n- drm/nouveau/gsp: Use the sg allocator for level 2 of radix3 (stable-fixes).\n- drm/panel: novatek-nt35950: fix return value check in nt35950_probe() (git-fixes).\n- drm/panel: simple: Add Microchip AC69T88A LVDS Display panel (stable-fixes).\n- drm/printer: Allow NULL data in devcoredump printer (stable-fixes).\n- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (stable-fixes).\n- drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() (stable-fixes).\n- drm/radeon: Fix spurious unplug event on radeon HDMI (git-fixes).\n- drm/radeon: add helper rdev_to_drm(rdev) (stable-fixes).\n- drm/radeon: change rdev-\u003eddev to rdev_to_drm(rdev) (stable-fixes).\n- drm/rcar-du: dsi: Fix PHY lock bit check (git-fixes).\n- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() (git-fixes).\n- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8 (git-fixes).\n- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset (git-fixes).\n- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0 (git-fixes).\n- drm/sched: memset() 'job' in drm_sched_job_init() (stable-fixes).\n- drm/tidss: Clear the interrupt status for interrupts being disabled (git-fixes).\n- drm/tidss: Fix issue in irq handling causing irq-flood issue (git-fixes).\n- drm/v3d: Assign job pointer to NULL before signaling the fence (git-fixes).\n- drm/v3d: Ensure job pointer is set to NULL after job completion (git-fixes).\n- drm/v3d: Stop active perfmon if it is being destroyed (git-fixes).\n- drm/vc4: hdmi: Avoid log spam for audio start failure (stable-fixes).\n- drm/vc4: hvs: Set AXI panic modes for the HVS (stable-fixes).\n- drm/vmwgfx: Add new keep_resv BO param (git-fixes).\n- drm: adv7511: Drop dsi single lane support (git-fixes).\n- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK (stable-fixes).\n- drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict (stable-fixes).\n- erofs: avoid debugging output for (de)compressed data (git-fixes).\n- exfat: ensure that ctime is updated whenever the mtime is (git-fixes).\n- exfat: fix the infinite loop in __exfat_free_cluster() (git-fixes).\n- exfat: fix the infinite loop in exfat_readdir() (git-fixes).\n- exfat: fix uninit-value in __exfat_get_dentry_set (git-fixes).\n- ext4: add a new helper to check if es must be kept (bsc#1234170).\n- ext4: add correct group descriptors and reserved GDT blocks to system zone (bsc#1234164).\n- ext4: add missed brelse in update_backups (bsc#1234171).\n- ext4: allow for the last group to be marked as trimmed (bsc#1234278).\n- ext4: avoid buffer_head leak in ext4_mark_inode_used() (bsc#1234191).\n- ext4: avoid excessive credit estimate in ext4_tmpfile() (bsc#1234180).\n- ext4: avoid negative min_clusters in find_group_orlov() (bsc#1234193).\n- ext4: avoid overlapping preallocations due to overflow (bsc#1234162).\n- ext4: avoid potential buffer_head leak in __ext4_new_inode() (bsc#1234192).\n- ext4: avoid writing unitialized memory to disk in EA inodes (bsc#1234187).\n- ext4: check the extent status again before inserting delalloc block (bsc#1234186).\n- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (bsc#1234190).\n- ext4: convert to exclusive lock while inserting delalloc extents (bsc#1234178).\n- ext4: correct best extent lstart adjustment logic (bsc#1234179).\n- ext4: correct grp validation in ext4_mb_good_group (bsc#1234163).\n- ext4: correct return value of ext4_convert_meta_bg (bsc#1234172).\n- ext4: correct the hole length returned by ext4_map_blocks() (bsc#1234178).\n- ext4: correct the start block of counting reserved clusters (bsc#1234169).\n- ext4: do not let fstrim block system suspend (https://bugzilla.kernel.org/show_bug.cgi?id=216322 bsc#1234166).\n- ext4: do not trim the group with corrupted block bitmap (bsc#1234177).\n- ext4: factor out __es_alloc_extent() and __es_free_extent() (bsc#1234170).\n- ext4: factor out a common helper to query extent map (bsc#1234186).\n- ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1234176).\n- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (bsc#1234188).\n- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (bsc#1234188).\n- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (bsc#1234188).\n- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954).\n- ext4: fix potential unnitialized variable (bsc#1234183).\n- ext4: fix race between writepages and remount (bsc#1234168).\n- ext4: fix rec_len verify error (bsc#1234167).\n- ext4: fix slab-use-after-free in ext4_es_insert_extent() (bsc#1234170).\n- ext4: fix uninitialized variable in ext4_inlinedir_to_tree (bsc#1234185).\n- ext4: forbid commit inconsistent quota data when errors=remount-ro (bsc#1234178).\n- ext4: make ext4_es_insert_delayed_block() return void (bsc#1234170).\n- ext4: make ext4_es_insert_extent() return void (bsc#1234170).\n- ext4: make ext4_es_remove_extent() return void (bsc#1234170).\n- ext4: make ext4_zeroout_es() return void (bsc#1234170).\n- ext4: make sure allocate pending entry not fail (bsc#1234170).\n- ext4: mark buffer new if it is unwritten to avoid stale data exposure (bsc#1234175).\n- ext4: move 'ix' sanity check to corrent position (bsc#1234174).\n- ext4: move setting of trimmed bit into ext4_try_to_trim_range() (bsc#1234165).\n- ext4: nested locking for xattr inode (bsc#1234189).\n- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (bsc#1234194).\n- ext4: refactor ext4_da_map_blocks() (bsc#1234178).\n- ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks (bsc#1234173).\n- ext4: remove the redundant folio_wait_stable() (bsc#1234184).\n- ext4: set the type of max_zeroout to unsigned int to avoid overflow (bsc#1234182).\n- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (bsc#1234181).\n- ext4: use pre-allocated es in __es_insert_extent() (bsc#1234170).\n- ext4: use pre-allocated es in __es_remove_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_delayed_block() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_insert_extent() (bsc#1234170).\n- ext4: using nofail preallocation in ext4_es_remove_extent() (bsc#1234170).\n- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() (git-fixes).\n- filemap: Fix bounds checking in filemap_read() (bsc#1234209).\n- filemap: add a per-mapping stable writes flag (bsc#1234141).\n- firmware: arm_scmi: Reject clear channel request on A2P (stable-fixes).\n- fs-writeback: do not requeue a clean inode having skipped pages (bsc#1234200).\n- fs/writeback: bail out if there is no more inodes for IO and queued once (bsc#1234207).\n- fsnotify: fix sending inotify event with unexpected filename (bsc#1234198).\n- genirq/cpuhotplug: Retry with cpu_online_mask when migration fails (git-fixes).\n- genirq/cpuhotplug: Skip suspended interrupts when restoring affinity (git-fixes).\n- genirq/irqdesc: Honor caller provided affinity in alloc_desc() (git-fixes).\n- genirq: Make handle_enforce_irqctx() unconditionally available (git-fixes).\n- genksyms: fix memory leak when the same symbol is added from source (git-fixes).\n- genksyms: fix memory leak when the same symbol is read from *.symref file (git-fixes).\n- gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (git-fixes).\n- gpio: grgpio: Add NULL check in grgpio_probe (git-fixes).\n- gpio: grgpio: use a helper variable to store the address of ofdev-\u003edev (stable-fixes).\n- gpio: mxc: remove dead code after switch to DT-only (git-fixes).\n- gpio: xilinx: Convert gpio_lock to raw spinlock (git-fixes).\n- hfsplus: do not query the device logical block size multiple times (git-fixes).\n- hvc/xen: fix console unplug (git-fixes).\n- hvc/xen: fix error path in xen_hvc_init() to always register frontend driver (git-fixes).\n- hvc/xen: fix event channel handling for secondary consoles (git-fixes).\n- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur (git-fixes).\n- hwmon: (drivetemp) Set scsi command timeout to 10s (stable-fixes).\n- hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list (stable-fixes).\n- hwmon: (pmbus/core) clear faults after setting smbalert mask (git-fixes).\n- hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK (stable-fixes).\n- hwmon: (tmp513) Do not use \"proxy\" headers (stable-fixes).\n- hwmon: (tmp513) Fix Current Register value interpretation (git-fixes).\n- hwmon: (tmp513) Fix division of negative numbers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers (git-fixes).\n- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers (git-fixes).\n- hwmon: (tmp513) Simplify with dev_err_probe() (stable-fixes).\n- hwmon: (tmp513) Use SI constants from units.h (stable-fixes).\n- hyperv: Do not overlap the hvcall IO areas in get_vtl() (git-fixes).\n- i2c: core: fix reference leak in i2c_register_adapter() (git-fixes).\n- i2c: i801: Add support for Intel Arrow Lake-H (stable-fixes).\n- i2c: i801: Add support for Intel Panther Lake (stable-fixes).\n- i2c: imx: add imx7d compatible string for applying erratum ERR007805 (git-fixes).\n- i2c: microchip-core: actually use repeated sends (git-fixes).\n- i2c: microchip-core: fix \"ghost\" detections (git-fixes).\n- i2c: mux: demux-pinctrl: check initial mux selection, too (git-fixes).\n- i2c: pnx: Fix timeout in wait functions (git-fixes).\n- i2c: rcar: fix NACK handling when being a target (git-fixes).\n- i2c: riic: Always round-up when calculating bus period (git-fixes).\n- i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros (stable-fixes).\n- i40e: Fix handling changed priv flags (git-fixes).\n- i915/guc: Accumulate active runtime on gt reset (git-fixes).\n- i915/guc: Ensure busyness counter increases motonically (git-fixes).\n- i915/guc: Reset engine utilization buffer before registration (git-fixes).\n- ibmvnic: Free any outstanding tx skbs during scrq reset (bsc#1226980).\n- ice: Unbind the workqueue (bsc#1234989)\n- ice: change q_index variable type to s16 to store -1 value (git-fixes).\n- ice: consistently use q_idx in ice_vc_cfg_qs_msg() (git-fixes).\n- ice: fix PHY Clock Recovery availability check (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() (git-fixes).\n- igb: Fix potential invalid memory access in igb_init_module() (git-fixes).\n- iio: adc: ad7124: Disable all channels at probe time (git-fixes).\n- iio: adc: ad_sigma_delta: Handle CS assertion as intended in ad_sd_read_reg_raw() (git-fixes).\n- iio: adc: at91: call input_free_device() on allocated iio_dev (git-fixes).\n- iio: adc: rockchip_saradc: fix information leak in triggered buffer (git-fixes).\n- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() (git-fixes).\n- iio: adc: ti-ads8688: fix information leak in triggered buffer (git-fixes).\n- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (git-fixes).\n- iio: gyro: fxas21002c: Fix missing data update in trigger handler (git-fixes).\n- iio: iio-mux: kzalloc instead of devm_kzalloc to ensure page alignment (git-fixes).\n- iio: imu: kmx61: fix information leak in triggered buffer (git-fixes).\n- iio: inkern: call iio_device_put() only on mapped devices (git-fixes).\n- iio: light: as73211: fix channel handling in only-color triggered buffer (git-fixes).\n- iio: light: vcnl4035: fix information leak in triggered buffer (git-fixes).\n- iio: magnetometer: yas530: use signed integer type for clamp limits (git-fixes).\n- iio: pressure: zpa2326: fix information leak in triggered buffer (git-fixes).\n- iio: test : check null return of kunit_kmalloc in iio_rescale_test_scale (git-fixes).\n- instrumentation: Wire up cmpxchg128() (bsc#1220773).\n- intel_th: core: fix kernel-doc warnings (git-fixes).\n- io_uring/rw: avoid punting to io-wq directly (git-fixes).\n- io_uring/tctx: work around xa_store() allocation error issue (git-fixes).\n- io_uring: Fix registered ring file refcount leak (git-fixes).\n- io_uring: always lock __io_cqring_overflow_flush (git-fixes).\n- io_uring: check if iowq is killed before queuing (git-fixes).\n- iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables (git-fixes).\n- ipmi: ipmb: Add check devm_kasprintf() returned value (git-fixes).\n- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response (git-fixes).\n- irqchip/gic-v3: Force propagation of the active state with a read-back (stable-fixes).\n- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base (stable-fixes).\n- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument (git-fixes).\n- isofs: handle CDs with bad root inode but good Joliet root directory (bsc#1234199).\n- ixgbe: downgrade logging of unsupported VF API version to debug (git-fixes).\n- ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 (git-fixes).\n- jffs2: Fix rtime decompressor (git-fixes).\n- jffs2: Prevent rtime decompress memory corruption (git-fixes).\n- jffs2: fix use of uninitialized variable (git-fixes).\n- jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (git-fixes).\n- jfs: array-index-out-of-bounds fix in dtReadFirst (git-fixes).\n- jfs: fix array-index-out-of-bounds in jfs_readdir (git-fixes).\n- jfs: fix shift-out-of-bounds in dbSplit (git-fixes).\n- jfs: xattr: check invalid xattr size more strictly (git-fixes).\n- kABI workaround for struct auto_pin_cfg_item change (git-fixes).\n- kABI workaround for struct drm_dp_mst_topology_mgr (git-fixes).\n- kabi/severities: make vcap_find_actionfield PASS (bsc#1220773)\n- kasan: make report_lock a raw spinlock (git-fixes).\n- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST (git-fixes).\n- kdb: Fix buffer overflow during tab-complete (bsc#1234652).\n- kdb: Fix console handling when editing and tab-completing commands (bsc#1234655).\n- kdb: Merge identical case statements in kdb_read() (bsc#1234657).\n- kdb: Use format-specifiers rather than memset() for padding in kdb_read() (bsc#1234658).\n- kdb: Use format-strings rather than '\\0' injection in kdb_read() (bsc#1234654).\n- kdb: Use the passed prompt in kdb_position_cursor() (bsc#1234654).\n- kdb: address -Wformat-security warnings (bsc#1234659).\n- kgdb: Flush console before entering kgdb on panic (bsc#1234651).\n- kheaders: Ignore silly-rename files (stable-fixes).\n- ktest.pl: Avoid false positives with grub2 skip regex (stable-fixes).\n- ktest.pl: Check kernelrelease return in get_version (git-fixes).\n- ktest.pl: Fix typo \"accesing\" (git-fixes).\n- ktest.pl: Fix typo in comment (git-fixes).\n- ktest.pl: Remove unused declarations in run_bisect_test function (git-fixes).\n- ktest: force $buildonly = 1 for 'make_warnings_file' test type (stable-fixes).\n- landlock: Handle weird files (git-fixes).\n- latencytop: use correct kernel-doc format for func params (git-fixes).\n- leds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex (stable-fixes).\n- leds: lp8860: Write full EEPROM, not only half of it (git-fixes).\n- leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata() (git-fixes).\n- lib/inflate.c: remove dead code (git-fixes).\n- lib/stackdepot: print disabled message only if truly disabled (git-fixes).\n- linux/dmaengine.h: fix a few kernel-doc warnings (git-fixes).\n- locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() (bsc#1220773 git-fix).\n- loop: fix the the direct I/O support check when used on top of block devices (bsc#1234143).\n- mac80211: fix user-power when emulating chanctx (stable-fixes).\n- mac802154: check local interfaces before deleting sdata list (stable-fixes).\n- mailbox: pcc: Add support for platform notification handling (stable-fixes).\n- mailbox: pcc: Support shared interrupt for multiple subspaces (stable-fixes).\n- mailbox: tegra-hsp: Clear mailbox before using message (git-fixes).\n- maple_tree: simplify split calculation (git-fixes).\n- media: camif-core: Add check for clk_enable() (git-fixes).\n- media: ccs: Clean up parsed CCS static data on parse failure (git-fixes).\n- media: ccs: Fix CCS static data parsing for large block sizes (git-fixes).\n- media: ccs: Fix cleanup order in ccs_probe() (git-fixes).\n- media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 (stable-fixes).\n- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (git-fixes).\n- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer (git-fixes).\n- media: i2c: imx412: Add missing newline to prints (git-fixes).\n- media: i2c: ov9282: Correct the exposure offset (git-fixes).\n- media: imx-jpeg: Fix potential error pointer dereference in detach_pm() (git-fixes).\n- media: imx296: Add standby delay during probe (git-fixes).\n- media: lmedm04: Handle errors for lme2510_int_read (git-fixes).\n- media: marvell: Add check for clk_enable() (git-fixes).\n- media: mc: fix endpoint iteration (git-fixes).\n- media: mipi-csis: Add check for clk_enable() (git-fixes).\n- media: nxp: imx8-isi: fix v4l2-compliance test errors (git-fixes).\n- media: ov5640: fix get_light_freq on auto (git-fixes).\n- media: rc: iguanair: handle timeouts (git-fixes).\n- media: rkisp1: Fix unused value issue (git-fixes).\n- media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera (stable-fixes).\n- media: uvcvideo: Fix crash during unbind if gpio unit is in use (git-fixes).\n- media: uvcvideo: Fix double free in error path (git-fixes).\n- media: uvcvideo: Fix event flags in uvc_ctrl_send_events (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4035 (stable-fixes).\n- media: uvcvideo: Only save async fh if success (git-fixes).\n- media: uvcvideo: Propagate buf-\u003eerror to userspace (git-fixes).\n- media: uvcvideo: RealSense D421 Depth module metadata (stable-fixes).\n- media: uvcvideo: Remove dangling pointers (git-fixes).\n- media: uvcvideo: Remove redundant NULL assignment (git-fixes).\n- media: uvcvideo: Support partial control reads (git-fixes).\n- memory tiering: count PGPROMOTE_SUCCESS when mem tiering is enabled (git-fixes).\n- memory-failure: use a folio in me_huge_page() (git-fixes).\n- memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() (git-fixes).\n- mfd: da9052-spi: Change read-mask to write-mask (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (git-fixes).\n- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (git-fixes).\n- misc: fastrpc: Deregister device nodes properly in error scenarios (git-fixes).\n- misc: fastrpc: Fix copy buffer page size (git-fixes).\n- misc: fastrpc: Fix registered buffer page address (git-fixes).\n- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling (git-fixes).\n- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config (git-fixes).\n- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm,page_owner: do not remove __GFP_NOLOCKDEP in add_stack_record_to_list (git-fixes).\n- mm/filemap: avoid buffered read/write race to read inconsistent data (bsc#1234204).\n- mm/memory-failure: cast index to loff_t before shifting it (git-fixes).\n- mm/memory-failure: check the mapcount of the precise page (git-fixes).\n- mm/memory-failure: fix crash in split_huge_page_to_list from soft_offline_page (git-fixes).\n- mm/memory-failure: pass the folio and the page to collect_procs() (git-fixes).\n- mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu (git-fixes).\n- mm/memory_hotplug: add missing mem_hotplug_lock (git-fixes).\n- mm/memory_hotplug: fix error handling in add_memory_resource() (git-fixes).\n- mm/memory_hotplug: prevent accessing by index=-1 (git-fixes).\n- mm/memory_hotplug: use pfn math in place of direct struct page manipulation (git-fixes).\n- mm/migrate: correct nr_failed in migrate_pages_sync() (git-fixes).\n- mm/migrate: fix deadlock in migrate_pages_batch() on large folios (git-fixes).\n- mm/migrate: putback split folios when numa hint migration fails (git-fixes).\n- mm/migrate: split source folio if it is on deferred split list (git-fixes).\n- mm/page_owner: remove free_ts from page_owner output (git-fixes).\n- mm/readahead: do not allow order-1 folio (bsc#1234205).\n- mm/readahead: limit page cache size in page_cache_ra_order() (bsc#1234208).\n- mm/rodata_test: use READ_ONCE() to read const variable (git-fixes).\n- mm: convert DAX lock/unlock page to lock/unlock folio (git-fixes).\n- mm: memory-failure: ensure moving HWPoison flag to the raw error pages (git-fixes).\n- mm: memory-failure: fetch compound head after extra page refcnt is held (git-fixes).\n- mm: memory-failure: fix potential page refcnt leak in memory_failure() (git-fixes).\n- mm: memory-failure: fix race window when trying to get hugetlb folio (git-fixes).\n- mm: memory-failure: remove unneeded PageHuge() check (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: core: Add SD card quirk for broken poweroff notification (stable-fixes).\n- mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting (git-fixes).\n- mmc: mtk-sd: fix devm_clk_get_optional usage (stable-fixes).\n- mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED (stable-fixes).\n- mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet (stable-fixes).\n- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk (git-fixes).\n- modpost: fix the missed iteration for the max bit in do_input() (git-fixes).\n- mtd: diskonchip: Cast an operand to prevent potential overflow (git-fixes).\n- mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).\n- mtd: hyperbus: rpc-if: Convert to platform remove callback returning void (stable-fixes).\n- mtd: onenand: Fix uninitialized retlen in do_otp_read() (git-fixes).\n- mtd: rawnand: arasan: Fix double assertion of chip-select (git-fixes).\n- mtd: rawnand: arasan: Fix missing de-registration of NAND (git-fixes).\n- mtd: rawnand: fix double free in atmel_pmecc_create_user() (git-fixes).\n- mtd: spinand: Remove write_enable_op() in markbad() (git-fixes).\n- net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (git-fixes).\n- net/ipv6: release expired exception dst cached in socket (bsc#1216813).\n- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (git-fixes).\n- net/mlx5e: Remove workaround to avoid syndrome for internal port (git-fixes).\n- net/mlx5e: clear xdp features on non-uplink representors (git-fixes).\n- net/qed: allow old cards not supporting \"num_images\" to work (git-fixes).\n- net/rose: prevent integer overflows in rose_setsockopt() (git-fixes).\n- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails (git-fixes).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset (git-fixes).\n- net: rose: fix timer races against user threads (git-fixes).\n- net: usb: qmi_wwan: add Quectel RG650V (stable-fixes).\n- net: usb: qmi_wwan: add Telit FE910C04 compositions (stable-fixes).\n- net: usb: rtl8150: enable basic endpoint checking (git-fixes).\n- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() (git-fixes).\n- net: wwan: t7xx: Fix FSM command timeout issue (git-fixes).\n- netfilter: nf_tables: validate family when identifying table via handle (bsc#1233778 ZDI-24-1454).\n- nfs: ignore SB_RDONLY when mounting nfs (git-fixes).\n- nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (git-fixes).\n- nfsd: make sure exp active before svc_export_show (git-fixes).\n- nfsd: release svc_expkey/svc_export with rcu_work (git-fixes).\n- nfsd: restore callback functionality for NFSv4.0 (git-fixes).\n- nilfs2: fix buffer head leaks in calls to truncate_inode_pages() (git-fixes).\n- nilfs2: fix possible int overflows in nilfs_fiemap() (git-fixes).\n- nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (git-fixes).\n- nilfs2: prevent use of deleted inode (git-fixes).\n- nvme-pci: 512 byte aligned dma pool segment quirk (git-fixes).\n- nvme-rdma: unquiesce admin_q before destroy it (git-fixes).\n- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (git-fixes).\n- nvme-tcp: fix the memleak while create new ctrl failed (git-fixes).\n- nvme/multipath: Fix RCU list traversal to use SRCU primitive (git-fixes).\n- nvme: Add error check for xa_store in nvme_get_effects_log (git-fixes).\n- nvme: Add error path for xa_store in nvme_init_effects (git-fixes).\n- nvme: apple: fix device reference counting (git-fixes).\n- nvme: fix bogus kzalloc() return check in nvme_init_effects_log() (git-fixes).\n- nvme: fix metadata handling in nvme-passthrough (git-fixes).\n- nvmet-loop: avoid using mutex in IO hotpath (git-fixes).\n- nvmet: propagate npwg topology (git-fixes).\n- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (git-fixes).\n- ocfs2: free inode when ocfs2_get_init_inode() fails (git-fixes).\n- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() (git-fixes).\n- of: Fix error path in of_parse_phandle_with_args_map() (git-fixes).\n- of: Fix refcount leakage for OF node returned by __of_get_dma_parent() (git-fixes).\n- of: address: Report error on resource bounds overflow (stable-fixes).\n- padata: add pd get/put refcnt helper (git-fixes).\n- padata: avoid UAF for reorder_work (git-fixes).\n- padata: fix UAF in padata_reorder (git-fixes).\n- parisc: Raise minimal GCC version (bsc#1220773).\n- parisc: Raise minimal GCC version to 12.0.0 (bsc#1220773 git-fix).\n- percpu: Add {raw,this}_cpu_try_cmpxchg() (bsc#1220773).\n- percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() (bsc#1220773 git-fix).\n- percpu: Wire up cmpxchg128 (bsc#1220773).\n- phy: core: Fix an OF node refcount leakage in _of_phy_get() (git-fixes).\n- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() (git-fixes).\n- phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider (git-fixes).\n- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy (git-fixes).\n- phy: core: Fix that API devm_phy_put() fails to release the phy (git-fixes).\n- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP (git-fixes).\n- phy: rockchip: naneng-combphy: fix phy reset (git-fixes).\n- phy: usb: Toggle the PHY power during init (git-fixes).\n- pinctrl: amd: Take suspend type into consideration which pins are non-wake (git-fixes).\n- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (git-fixes).\n- pinctrl: qcom-pmic-gpio: add support for PM8937 (stable-fixes).\n- pinctrl: qcom: spmi-mpp: Add PM8937 compatible (stable-fixes).\n- pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails (git-fixes).\n- pinmux: Use sequential access to access desc-\u003epinmux data (stable-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it (git-fixes).\n- platform/x86/intel-uncore-freq: Ignore minor version change (bsc#1225897).\n- platform/x86/intel/tpmi: Add defines to get version information (bsc#1225897).\n- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF (stable-fixes).\n- platform/x86: dell-smbios-base: Extends support to Alienware products (stable-fixes).\n- platform/x86: dell-wmi-base: Handle META key Lock/Unlock events (stable-fixes).\n- platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed (stable-fixes).\n- pm:cpupower: Add missing powercap_set_enabled() stub function (git-fixes).\n- power: ip5xxx_power: Fix return value on ADC read errors (git-fixes).\n- power: supply: gpio-charger: Fix set charge current limits (git-fixes).\n- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active (bsc#1235108).\n- powerpc/iommu: Move pSeries specific functions to pseries/iommu.c (bsc#1220711 ltc#205755).\n- powerpc/iommu: Only build sPAPR access functions on pSeries (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove MVE code (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove ioda1 support (bsc#1220711 ltc#205755).\n- powerpc/powernv/pci: Remove last IODA1 defines (bsc#1220711 ltc#205755).\n- powerpc/pseries/eeh: Fix get PE state translation (bsc#1215199).\n- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).\n- powerpc/pseries/vas: Add close() callback in vas_vm_ops struct (bsc#1234825).\n- pps: add an error check in parport_attach (git-fixes).\n- pps: remove usage of the deprecated ida_simple_xx() API (stable-fixes).\n- printk: Add is_printk_legacy_deferred() (bsc#1236733).\n- printk: Defer legacy printing when holding printk_cpu_sync (bsc#1236733).\n- proc/softirqs: replace seq_printf with seq_put_decimal_ull_width (git-fixes).\n- pwm: stm32-lp: Add check for clk_enable() (git-fixes).\n- pwm: stm32: Add check for clk_enable() (git-fixes).\n- quota: Fix rcu annotations of inode dquot pointers (bsc#1234197).\n- quota: explicitly forbid quota files from being encrypted (bsc#1234196).\n- quota: flush quota_release_work upon quota writeback (bsc#1234195).\n- quota: simplify drop_dquot_ref() (bsc#1234197).\n- rcu-tasks: Pull sampling of -\u003epercpu_dequeue_lim out of loop (git-fixes)\n- rcu/tree: Defer setting of jiffies during stall reset (git-fixes)\n- rcu: Dump memory object info if callback function is invalid (git-fixes)\n- rcu: Eliminate rcu_gp_slow_unregister() false positive (git-fixes)\n- rcuscale: Move rcu_scale_writer() (git-fixes)\n- rdma/cxgb4: Prevent potential integer overflow on 32bit (git-fixes)\n- readahead: use ilog2 instead of a while loop in page_cache_ra_order() (bsc#1234208).\n- regmap: Use correct format specifier for logging range errors (stable-fixes).\n- regulator: core: Add missing newline character (git-fixes).\n- regulator: of: Implement the unwind path of of_regulator_match() (git-fixes).\n- regulator: rk808: Add apply_bit for BUCK3 on RK809 (stable-fixes).\n- remoteproc: core: Fix ida_free call while not allocated (git-fixes).\n- rtc: cmos: avoid taking rtc_lock for extended period of time (stable-fixes).\n- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (git-fixes).\n- rtc: zynqmp: Fix optional clock name property (git-fixes).\n- s390/cio: Do not unregister the subchannel based on DNV (git-fixes).\n- s390/cpum_sf: Convert to cmpxchg128() (bsc#1220773).\n- s390/cpum_sf: Handle CPU hotplug remove during sampling (git-fixes).\n- s390/cpum_sf: Remove WARN_ON_ONCE statements (git-fixes).\n- s390/facility: Disable compile time optimization for decompressor code (git-fixes).\n- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (git-fixes).\n- s390/pageattr: Implement missing kernel_page_present() (git-fixes).\n- s390x config: IOMMU_DEFAULT_DMA_LAZY=y (bsc#1235646)\n- samples/landlock: Fix possible NULL dereference in parse_path() (git-fixes).\n- scatterlist: fix incorrect func name in kernel-doc (git-fixes).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat (bsc#1235865).\n- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat -kabi (bsc#1235865).\n- sched/numa: fix memory leak due to the overwritten vma-\u003enumab_state (git fixes (sched/numa)).\n- scsi: lpfc: Add handling for LS_RJT reason explanation authentication required (bsc#1235409).\n- scsi: lpfc: Add support for large fw object application layer reads (bsc#1235409).\n- scsi: lpfc: Change lpfc_nodelist save_flags member into a bitmask (bsc#1235409).\n- scsi: lpfc: Copyright updates for 14.4.0.7 patches (bsc#1235409).\n- scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (bsc#1235409).\n- scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (bsc#1235409).\n- scsi: lpfc: Redefine incorrect type in lpfc_create_device_data() (bsc#1235409).\n- scsi: lpfc: Restrict the REG_FCFI MAM field to FCoE adapters only (bsc#1235409).\n- scsi: lpfc: Update definition of firmware configuration mbox cmds (bsc#1235409).\n- scsi: lpfc: Update lpfc version to 14.4.0.7 (bsc#1235409).\n- scsi: qla2xxx: Fix NVMe and NPIV connect issue (bsc#1235406).\n- scsi: qla2xxx: Fix abort in bsg timeout (bsc#1235406).\n- scsi: qla2xxx: Fix use after free on unload (bsc#1235406).\n- scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt (bsc#1235406).\n- scsi: qla2xxx: Remove the unused 'del_list_entry' field in struct fc_port (bsc#1235406).\n- scsi: qla2xxx: Supported speed displayed incorrectly for VPorts (bsc#1235406).\n- scsi: qla2xxx: Update version to 10.02.09.400-k (bsc#1235406).\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (git-fixes).\n- seccomp: Stub for !CONFIG_SECCOMP (stable-fixes).\n- selftest: media_tests: fix trivial UAF typo (git-fixes).\n- selftests/alsa: Fix circular dependency involving global-timer (stable-fixes).\n- selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 (git-fixes).\n- selftests/landlock: Fix error message (git-fixes).\n- selftests/mm/cow: modify the incorrect checking parameters (git-fixes).\n- selftests/powerpc: Fix argument order to timer_sub() (git-fixes).\n- selftests: harness: fix printing of mismatch values in __EXPECT() (git-fixes).\n- selftests: mptcp: avoid spurious errors on disconnect (git-fixes).\n- selftests: tc-testing: reduce rshift value (stable-fixes).\n- selftests: timers: clocksource-switch: Adapt progress to kselftest framework (git-fixes).\n- selinux: Fix SCTP error inconsistency in selinux_socket_bind() (git-fixes).\n- serial: 8250: Adjust the timeout for FIFO mode (git-fixes).\n- serial: 8250_dw: Add Sophgo SG2044 quirk (stable-fixes).\n- serial: 8250_dw: Do not use struct dw8250_data outside of 8250_dw (git-fixes).\n- serial: 8250_dw: Replace ACPI device check by a quirk (git-fixes).\n- serial: 8250_fintek: Add support for F81216E (stable-fixes).\n- serial: Do not hold the port lock when setting rx-during-tx GPIO (git-fixes).\n- serial: amba-pl011: Fix RX stall when DMA is used (git-fixes).\n- serial: amba-pl011: Use port lock wrappers (stable-fixes).\n- serial: amba-pl011: fix build regression (git-fixes).\n- serial: do not use uninitialized value in uart_poll_init() (git-fixes).\n- serial: imx: only set receiver level if it is zero (git-fixes).\n- serial: imx: set receiver level before starting uart (git-fixes).\n- serial: qcom-geni: Do not cancel/abort if we can't get the port lock (git-fixes).\n- serial: qcom-geni: disable interrupts during console writes (git-fixes).\n- serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit() (git-fixes).\n- serial: qcom-geni: fix console corruption (git-fixes).\n- serial: qcom-geni: fix dma rx cancellation (git-fixes).\n- serial: qcom-geni: fix false console tx restart (git-fixes).\n- serial: qcom-geni: fix fifo polling timeout (git-fixes).\n- serial: qcom-geni: fix hard lockup on buffer flush (git-fixes).\n- serial: qcom-geni: fix polled console corruption (git-fixes).\n- serial: qcom-geni: fix polled console initialisation (git-fixes).\n- serial: qcom-geni: fix receiver enable (git-fixes).\n- serial: qcom-geni: fix shutdown race (git-fixes).\n- serial: qcom-geni: fix soft lockup on sw flow control and suspend (git-fixes).\n- serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield() (git-fixes).\n- serial: qcom-geni: revert broken hibernation support (git-fixes).\n- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use (git-fixes).\n- serial: sh-sci: Drop __initdata macro for port_cfg (git-fixes).\n- serial: stm32: Return IRQ_NONE in the ISR if no handling happend (git-fixes).\n- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled (git-fixes).\n- series.conf: temporarily disable upstream patch patches.suse/ocfs2-fix-UBSAN-warning-in-ocfs2_verify_volume.patch (bsc#1236138)\n- slub: Replace cmpxchg_double() (bsc#1220773).\n- slub: Replace cmpxchg_double() - KABI fix (bsc#1220773).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: fix issue described in bsc#1233642]\n- soc/fsl: cpm: qmc: Convert to platform remove callback returning void (stable-fixes).\n- soc: atmel: fix device_node release in atmel_soc_device_init() (git-fixes).\n- soc: fsl: cpm1: qmc: Fix blank line and spaces (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version (stable-fixes).\n- soc: fsl: cpm1: qmc: Re-order probe() operations (stable-fixes).\n- soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure (git-fixes).\n- soc: imx8m: Probe the SoC driver as platform driver (stable-fixes).\n- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths (git-fixes).\n- soc: qcom: Add check devm_kasprintf() returned value (stable-fixes).\n- soc: qcom: geni-se: Add M_TX_FIFO_NOT_EMPTY bit definition (git-fixes).\n- soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers (git-fixes).\n- soc: qcom: smem_state: fix missing of_node_put in error path (git-fixes).\n- soc: qcom: socinfo: Avoid out of bounds read of serial number (git-fixes).\n- soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (git-fixes).\n- sound: usb: enable DSD output for ddHiFi TC44C (stable-fixes).\n- sound: usb: format: do not warn that raw DSD is unsupported (stable-fixes).\n- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user() (git-fixes).\n- spi: zynq-qspi: Add check for clk_enable() (git-fixes).\n- srcu: Fix srcu_struct node grpmask overflow on 64-bit systems (git-fixes)\n- srcu: Only accelerate on enqueue time (git-fixes)\n- stackdepot: rename pool_index to pool_index_plus_1 (git-fixes).\n- stackdepot: respect __GFP_NOLOCKDEP allocation flag (git-fixes).\n- staging: iio: ad9832: Correct phase range check (git-fixes).\n- staging: iio: ad9834: Correct phase range check (git-fixes).\n- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() (git-fixes).\n- staging: media: max96712: fix kernel oops when removing module (git-fixes).\n- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (git-fixes).\n- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (git-fixes).\n- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() (git-fixes).\n- supported.conf: Add support for v4l2-dv-timings (jsc#PED-8645)\n- svcrdma: Address an integer overflow (git-fixes).\n- svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (git-fixes).\n- swiotlb: Enforce page alignment in swiotlb_alloc() (git-fixes).\n- swiotlb: Reinstate page-alignment for mappings \u003e= PAGE_SIZE (git-fixes).\n- thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens (stable-fixes).\n- thermal: of: fix OF node leak in of_thermal_zone_find() (git-fixes).\n- thunderbolt: Add support for Intel Lunar Lake (stable-fixes).\n- thunderbolt: Add support for Intel Panther Lake-M/P (stable-fixes).\n- tipc: fix NULL deref in cleanup_bearer() (bsc#1235433).\n- tools: Sync if_xdp.h uapi tooling header (git-fixes).\n- tools: hv: change permissions of NetworkManager configuration file (git-fixes).\n- tpm/eventlog: Limit memory allocations for event logs with excessive size (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm: Map the ACPI provided event log (bsc#1233260 bsc#1233259 bsc#1232421).\n- tpm_tis_spi: Release chip select when flow control fails (bsc#1234338)\n- tty: serial: 8250: Fix another runtime PM usage counter underflow (git-fixes).\n- tty: serial: kgdboc: Fix 8250_* kgdb over serial (git-fixes).\n- types: Introduce [us]128 (bsc#1220773).\n- ubifs: Correct the total block count by deducting journal reservation (git-fixes).\n- ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (git-fixes).\n- ubifs: skip dumping tnc tree when zroot is null (git-fixes).\n- udf: Fix lock ordering in udf_evict_inode() (bsc#1234238).\n- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243).\n- udf: prevent integer overflow in udf_bitmap_free_blocks() (bsc#1234239).\n- udf: refactor inode_bmap() to handle error (bsc#1234242).\n- udf: refactor udf_current_aext() to handle error (bsc#1234240).\n- udf: refactor udf_next_aext() to handle error (bsc#1234241).\n- udf: udftime: prevent overflow in udf_disk_stamp_to_time() (bsc#1234237).\n- uio: Fix return value of poll (git-fixes).\n- uio: uio_dmem_genirq: check the return value of devm_kasprintf() (git-fixes).\n- usb-storage: Add max sectors quirk for Nokia 208 (stable-fixes).\n- usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver (stable-fixes).\n- usb: cdns3-ti: Add workaround for Errata i2409 (stable-fixes).\n- usb: cdns3: Add quirk flag to enable suspend residency (stable-fixes).\n- usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag (stable-fixes).\n- usb: chipidea: udc: handle USB Error Interrupt if IOC not set (stable-fixes).\n- usb: dwc2: Fix HCD port connection race (git-fixes).\n- usb: dwc2: Fix HCD resume (git-fixes).\n- usb: dwc2: gadget: Do not write invalid mapped sg entries into dma_desc with iommu enabled (stable-fixes).\n- usb: dwc2: hcd: Fix GetPortStatus \u0026 SetPortFeature (git-fixes).\n- usb: dwc3-am62: Disable autosuspend during remove (git-fixes).\n- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk() (git-fixes).\n- usb: dwc3: ep0: Do not clear ep0 DWC3_EP_TRANSFER_STARTED (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (git-fixes).\n- usb: dwc3: ep0: Do not reset resource alloc flag (including ep0) (git-fixes).\n- usb: dwc3: gadget: Rewrite endpoint allocation flow (stable-fixes).\n- usb: dwc3: gadget: fix writing NYET threshold (git-fixes).\n- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode (git-fixes).\n- usb: ehci-hcd: fix call balance of clocks handling routines (git-fixes).\n- usb: fix reference leak in usb_new_device() (git-fixes).\n- usb: gadget: configfs: Ignore trailing LF for user strings to cdev (git-fixes).\n- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (git-fixes).\n- usb: gadget: f_tcm: Decrement command ref count on cleanup (git-fixes).\n- usb: gadget: f_tcm: Do not free command immediately (git-fixes).\n- usb: gadget: f_tcm: Do not prepare BOT write request twice (git-fixes).\n- usb: gadget: f_tcm: Fix Get/SetInterface return value (git-fixes).\n- usb: gadget: f_tcm: Translate error to sense (git-fixes).\n- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint (git-fixes).\n- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints (git-fixes).\n- usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null (git-fixes).\n- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (git-fixes).\n- usb: host: max3421-hcd: Correctly abort a USB request (git-fixes).\n- usb: host: xhci-plat: Assign shared_hcd-\u003ersrc_start (git-fixes).\n- usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe() (git-fixes).\n- usb: typec: anx7411: fix fwnode_handle reference leak (git-fixes).\n- usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() (bsc#1235001)\n- usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() (git-fixes).\n- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE (git-fixes).\n- usb: typec: use cleanup facility for 'altmodes_node' (stable-fixes).\n- usbnet: ipheth: break up NCM header size computation (git-fixes).\n- usbnet: ipheth: check that DPE points past NCM header (git-fixes).\n- usbnet: ipheth: fix DPE OoB read (git-fixes).\n- usbnet: ipheth: fix possible overflow in DPE length check (git-fixes).\n- usbnet: ipheth: refactor NCM datagram loop (git-fixes).\n- usbnet: ipheth: use static NDP16 location in URB (git-fixes).\n- vDPA/ifcvf: Fix pci_read_config_byte() return code handling (git-fixes).\n- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map (git-fixes).\n- vdpa/mlx5: Fix suboptimal range on iotlb iteration (git-fixes).\n- vdpa: solidrun: Fix UB bug with devres (git-fixes).\n- vfs: fix readahead(2) on block devices (bsc#1234201).\n- vmscan,migrate: fix page count imbalance on node stats when demoting pages (git-fixes).\n- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler (stable-fixes).\n- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset (stable-fixes).\n- watchdog: rzg2l_wdt: Remove reset de-assert from probe (stable-fixes).\n- wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855 (git-fixes).\n- wifi: ath11k: cleanup struct ath11k_mon_data (git-fixes).\n- wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() (stable-fixes).\n- wifi: ath12k: fix tx power, max reg power update to firmware (git-fixes).\n- wifi: ath5k: add PCI ID for Arcadyan devices (git-fixes).\n- wifi: ath5k: add PCI ID for SX76X (git-fixes).\n- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (stable-fixes).\n- wifi: brcmfmac: add missing header include for brcmf_dbg (git-fixes).\n- wifi: cfg80211: adjust allocation of colocated AP data (git-fixes).\n- wifi: cfg80211: sme: init n_channels before channels[] access (git-fixes).\n- wifi: cw1200: Fix potential NULL dereference (git-fixes).\n- wifi: ipw2x00: libipw_rx_any(): fix bad alignment (stable-fixes).\n- wifi: iwlwifi: fw: read STEP table from correct UEFI var (git-fixes).\n- wifi: iwlwifi: mvm: Use the sync timepoint API in suspend (stable-fixes).\n- wifi: mac80211: Add non-atomic station iterator (stable-fixes).\n- wifi: mac80211: Fix common size calculation for ML element (git-fixes).\n- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters() (stable-fixes).\n- wifi: mac80211: do not flush non-uploaded STAs (git-fixes).\n- wifi: mac80211: export ieee80211_purge_tx_queue() for drivers (stable-fixes).\n- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (stable-fixes).\n- wifi: mac80211: fix station NSS capability initialization order (git-fixes).\n- wifi: mac80211: fix tid removal during mesh forwarding (git-fixes).\n- wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon (git-fixes).\n- wifi: mac80211: prohibit deactivating all links (git-fixes).\n- wifi: mac80211: wake the queues in case of failure in resume (stable-fixes).\n- wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO (git-fixes).\n- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC (git-fixes).\n- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 (git-fixes).\n- wifi: mt76: mt7915: firmware restart on devices with a second pcie link (git-fixes).\n- wifi: mt76: mt7915: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7915: fix register mapping (git-fixes).\n- wifi: mt76: mt7921: fix using incorrect group cipher after disconnection (git-fixes).\n- wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (git-fixes).\n- wifi: mt76: mt7996: add max mpdu len capability (git-fixes).\n- wifi: mt76: mt7996: fix HE Phy capability (git-fixes).\n- wifi: mt76: mt7996: fix definition of tx descriptor (git-fixes).\n- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event (git-fixes).\n- wifi: mt76: mt7996: fix ldpc setting (git-fixes).\n- wifi: mt76: mt7996: fix overflows seen when writing limit attributes (git-fixes).\n- wifi: mt76: mt7996: fix register mapping (git-fixes).\n- wifi: mt76: mt7996: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU (git-fixes).\n- wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (git-fixes).\n- wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (stable-fixes).\n- wifi: rtlwifi: destroy workqueue at rtl_deinit_core (git-fixes).\n- wifi: rtlwifi: do not complete firmware loading needlessly (git-fixes).\n- wifi: rtlwifi: fix init_sw_vars leak when probe fails (git-fixes).\n- wifi: rtlwifi: fix memory leaks and invalid access at probe error path (git-fixes).\n- wifi: rtlwifi: pci: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtlwifi: remove unused check_buddy_priv (git-fixes).\n- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix media status report (git-fixes).\n- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop (git-fixes).\n- wifi: rtlwifi: usb: fix workqueue leak when probe fails (git-fixes).\n- wifi: rtlwifi: wait for firmware loading before releasing memory (git-fixes).\n- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb (stable-fixes).\n- wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (stable-fixes).\n- wifi: rtw89: mcc: consider time limits not divisible by 1024 (git-fixes).\n- wifi: wcn36xx: fix channel survey memory allocation size (git-fixes).\n- wifi: wlcore: fix unbalanced pm_runtime calls (git-fixes).\n- workqueue: Add rcu lock check at the end of work item execution (bsc#1236732).\n- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (bsc#1235416).\n- writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (bsc#1234203).\n- x86,amd_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86,intel_iommu: Replace cmpxchg_double() (bsc#1220773).\n- x86/hyperv: Fix hv tsc page based sched_clock for hibernation (git-fixes).\n- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0 (git-fixes).\n- xfs: Add error handling for xfs_reflink_cancel_cow_range (git-fixes).\n- xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end (git-fixes).\n- xfs: do not allocate COW extents when unsharing a hole (git-fixes).\n- xfs: fix sb_spino_align checks for large fsblock sizes (git-fixes).\n- xfs: remove unknown compat feature check in superblock write validation (git-fixes).\n- xfs: return from xfs_symlink_verify early on V4 filesystems (git-fixes).\n- xfs: sb_spino_align is not verified (git-fixes).\n- xhci: Add usb cold attach (CAS) as a reason to resume root hub (git-fixes).\n- xhci: Allow RPM on the USB controller (1022:43f7) by default (stable-fixes).\n- xhci: fix possible null pointer deref during xhci urb enqueue (git-fixes).\n","status":"published","published":"2025-03-28T07:51:47Z","modified":"2026-03-23T04:48:13.92582Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7310-1","title":"linux-oem-6.11 vulnerabilities","description":"Attila Szász discovered that the HFS+ file system implementation in the\nLinux Kernel contained a heap overflow vulnerability. An attacker could use\na specially crafted file system image that, when mounted, could cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2025-0927)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - RAM backed block device driver;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DAX dirext access to differentiated memory framework;\n  - Buffer Sharing and Synchronization framework;\n  - EDAC drivers;\n  - FireWire subsystem;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - Qualcomm firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NTB driver;\n  - Virtio pmem driver;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - Alibaba DDR Sub-System Driveway PMU driver;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - SuperH / SH-Mobile drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Direct Digital Synthesis drivers;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Device Class drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - TI TPS6598x USB Power Delivery controller driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - UBI file system;\n  - BPF subsystem;\n  - Network file system (NFS) superblock;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - Network traffic control;\n  - Network sockets;\n  - TCP network protocol;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel fork() syscall;\n  - Kernel thread helper (kthread);\n  - Padata parallel execution mechanism;\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Static call mechanism;\n  - Task handling mechanism;\n  - Timer substystem drivers;\n  - Maple Tree data structure library;\n  - Memory management;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - L2TP protocol;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - Netfilter;\n  - Netlink;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - AudioScience HPI driver;\n  - HD-audio driver;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM core;\n(CVE-2024-50244, CVE-2024-56754, CVE-2024-50082, CVE-2024-47737,\nCVE-2024-50300, CVE-2024-49872, CVE-2024-50180, CVE-2024-50218,\nCVE-2024-49956, CVE-2024-53189, CVE-2024-56705, CVE-2024-50119,\nCVE-2024-53192, CVE-2024-49950, CVE-2024-56722, CVE-2024-49943,\nCVE-2024-50031, CVE-2024-47685, CVE-2024-50296, CVE-2024-49939,\nCVE-2024-47696, CVE-2024-47752, CVE-2024-49937, CVE-2024-53140,\nCVE-2024-50236, CVE-2024-50151, CVE-2024-50069, CVE-2024-50170,\nCVE-2024-50246, CVE-2024-50217, CVE-2024-53125, CVE-2024-50084,\nCVE-2024-50005, CVE-2024-53137, CVE-2024-50233, CVE-2024-49991,\nCVE-2024-50067, CVE-2024-50290, CVE-2024-47735, CVE-2024-53133,\nCVE-2024-50289, CVE-2024-49855, CVE-2024-49868, CVE-2024-56728,\nCVE-2024-56726, CVE-2024-50012, CVE-2024-53078, CVE-2024-50223,\nCVE-2024-50143, CVE-2024-50287, CVE-2024-49971, CVE-2024-49900,\nCVE-2024-50263, CVE-2024-50206, CVE-2024-47707, CVE-2024-47751,\nCVE-2024-56747, CVE-2024-50260, CVE-2024-50173, CVE-2024-47680,\nCVE-2024-50009, CVE-2024-53219, CVE-2024-53144, CVE-2024-50008,\nCVE-2024-53208, CVE-2024-49966, CVE-2024-50104, CVE-2024-50030,\nCVE-2024-53049, CVE-2024-53201, CVE-2024-50130, CVE-2024-49856,\nCVE-2024-53095, CVE-2024-50033, CVE-2024-47730, CVE-2024-53216,\nCVE-2024-50286, CVE-2024-50284, CVE-2024-47744, CVE-2023-52917,\nCVE-2024-50275, CVE-2024-53114, CVE-2024-49968, CVE-2024-50111,\nCVE-2024-50000, CVE-2024-53081, CVE-2024-49857, CVE-2024-50262,\nCVE-2024-50281, CVE-2024-53156, CVE-2024-50225, CVE-2024-53239,\nCVE-2024-50036, CVE-2024-50187, CVE-2024-53165, CVE-2024-49931,\nCVE-2024-53111, CVE-2024-49862, CVE-2024-47701, CVE-2024-53091,\nCVE-2024-50103, CVE-2024-53046, CVE-2024-56678, CVE-2024-56749,\nCVE-2024-53175, CVE-2024-49970, CVE-2024-50035, CVE-2024-50088,\nCVE-2024-50297, CVE-2024-47721, CVE-2024-50240, CVE-2024-50076,\nCVE-2024-56683, CVE-2024-53120, CVE-2024-50074, CVE-2024-50095,\nCVE-2024-49963, CVE-2024-50158, CVE-2024-50020, CVE-2024-53083,\nCVE-2024-50029, CVE-2024-56755, CVE-2024-49969, CVE-2024-50022,\nCVE-2024-50278, CVE-2024-50125, CVE-2024-47706, CVE-2024-50204,\nCVE-2024-56543, CVE-2024-53108, CVE-2024-49885, CVE-2024-50128,\nCVE-2024-50062, CVE-2024-50139, CVE-2024-50183, CVE-2024-50288,\nCVE-2024-56729, CVE-2024-49945, CVE-2024-47695, CVE-2024-56533,\nCVE-2024-53234, CVE-2024-50002, CVE-2024-50040, CVE-2024-49903,\nCVE-2024-47702, CVE-2024-47728, CVE-2024-49874, CVE-2024-47718,\nCVE-2024-53142, CVE-2024-49983, CVE-2024-50211, CVE-2024-50294,\nCVE-2024-50132, CVE-2024-53236, CVE-2024-50042, CVE-2024-49999,\nCVE-2024-50001, CVE-2024-50046, CVE-2024-50133, CVE-2024-50256,\nCVE-2024-49869, CVE-2024-49852, CVE-2024-47717, CVE-2024-56704,\nCVE-2024-50102, CVE-2024-50150, CVE-2024-49880, CVE-2024-50235,\nCVE-2024-49892, CVE-2024-53194, CVE-2024-53104, CVE-2024-50232,\nCVE-2024-50226, CVE-2024-56684, CVE-2024-47713, CVE-2024-50191,\nCVE-2024-49850, CVE-2024-50277, CVE-2024-53113, CVE-2024-50013,\nCVE-2024-53221, CVE-2024-50220, CVE-2024-49960, CVE-2024-53228,\nCVE-2024-50152, CVE-2024-56689, CVE-2024-53220, CVE-2024-50209,\nCVE-2024-50285, CVE-2024-50197, CVE-2024-53072, CVE-2024-50273,\nCVE-2024-49928, CVE-2024-53132, CVE-2024-56720, CVE-2024-50194,\nCVE-2024-50112, CVE-2024-53079, CVE-2024-56696, CVE-2024-47750,\nCVE-2024-53212, CVE-2024-56541, CVE-2024-50024, CVE-2024-53168,\nCVE-2024-50247, CVE-2024-50193, CVE-2024-47754, CVE-2024-56540,\nCVE-2024-50026, CVE-2024-53047, CVE-2024-53151, CVE-2024-50176,\nCVE-2024-49975, CVE-2024-50034, CVE-2024-50126, CVE-2024-49863,\nCVE-2024-47693, CVE-2024-49954, CVE-2024-49938, CVE-2024-50171,\nCVE-2024-50185, CVE-2024-50200, CVE-2024-50201, CVE-2024-53184,\nCVE-2024-47709, CVE-2024-50138, CVE-2024-49935, CVE-2024-50049,\nCVE-2024-56537, CVE-2024-50057, CVE-2024-56677, CVE-2024-47743,\nCVE-2024-50293, CVE-2024-50099, CVE-2024-47720, CVE-2024-50021,\nCVE-2024-50059, CVE-2024-49871, CVE-2024-49884, CVE-2024-47694,\nCVE-2024-56723, CVE-2024-47724, CVE-2024-50038, CVE-2024-53123,\nCVE-2024-53177, CVE-2024-49932, CVE-2024-50196, CVE-2024-50234,\nCVE-2024-50078, CVE-2024-53043, CVE-2024-49926, CVE-2024-49988,\nCVE-2024-53187, CVE-2024-53056, CVE-2024-53217, CVE-2024-56745,\nCVE-2024-47726, CVE-2024-50063, CVE-2024-49987, CVE-2024-49955,\nCVE-2024-50179, CVE-2024-49866, CVE-2024-50283, CVE-2024-49997,\nCVE-2024-47742, CVE-2024-56691, CVE-2024-50253, CVE-2024-56690,\nCVE-2024-47710, CVE-2024-53129, CVE-2024-50190, CVE-2024-50090,\nCVE-2024-56702, CVE-2024-50148, CVE-2024-53183, CVE-2024-50070,\nCVE-2024-50154, CVE-2024-50243, CVE-2024-50003, CVE-2024-50117,\nCVE-2024-56751, CVE-2024-56697, CVE-2024-53166, CVE-2024-53196,\nCVE-2024-47677, CVE-2024-56679, CVE-2024-49996, CVE-2024-47681,\nCVE-2024-53181, CVE-2024-47700, CVE-2024-53071, CVE-2024-50015,\nCVE-2024-53126, CVE-2024-50165, CVE-2024-50172, CVE-2024-53063,\nCVE-2024-53200, CVE-2024-53135, CVE-2024-49974, CVE-2024-53088,\nCVE-2024-49936, CVE-2024-53121, CVE-2024-50166, CVE-2024-50087,\nCVE-2024-53065, CVE-2024-53214, CVE-2024-53076, CVE-2024-53059,\nCVE-2024-50230, CVE-2024-49985, CVE-2024-50092, CVE-2024-53233,\nCVE-2024-50047, CVE-2024-56685, CVE-2024-47682, CVE-2024-47705,\nCVE-2024-50077, CVE-2024-53224, CVE-2024-49887, CVE-2024-49940,\nCVE-2024-47741, CVE-2024-49858, CVE-2024-56536, CVE-2024-53055,\nCVE-2024-56687, CVE-2024-50100, CVE-2024-53075, CVE-2024-47699,\nCVE-2024-53213, CVE-2024-49977, CVE-2024-50268, CVE-2024-53146,\nCVE-2024-50304, CVE-2024-50096, CVE-2024-53162, CVE-2024-56725,\nCVE-2024-49953, CVE-2024-53077, CVE-2024-50107, CVE-2024-53226,\nCVE-2024-53134, CVE-2024-49873, CVE-2024-56548, CVE-2024-53145,\nCVE-2024-53141, CVE-2024-56741, CVE-2024-53067, CVE-2024-53152,\nCVE-2024-50072, CVE-2024-50282, CVE-2024-53232, CVE-2024-50140,\nCVE-2024-53198, CVE-2024-53150, CVE-2024-49876, CVE-2024-50302,\nCVE-2024-53115, CVE-2024-47692, CVE-2024-50301, CVE-2024-50202,\nCVE-2024-50155, CVE-2024-56693, CVE-2024-53082, CVE-2024-53167,\nCVE-2024-56748, CVE-2024-53064, CVE-2024-50227, CVE-2024-56539,\nCVE-2024-50215, CVE-2024-50043, CVE-2024-50146, CVE-2024-50147,\nCVE-2024-56699, CVE-2024-50122, CVE-2024-53044, CVE-2024-47712,\nCVE-2024-53230, CVE-2024-50121, CVE-2024-50216, CVE-2024-53084,\nCVE-2024-56703, CVE-2024-50178, CVE-2024-49934, CVE-2024-47678,\nCVE-2024-50271, CVE-2024-50144, CVE-2024-50252, CVE-2024-47734,\nCVE-2024-47711, CVE-2024-50214, CVE-2024-53100, CVE-2024-56680,\nCVE-2024-50198, CVE-2024-50025, CVE-2024-50044, CVE-2024-50098,\nCVE-2024-47745, CVE-2024-49860, CVE-2024-49881, CVE-2024-53048,\nCVE-2024-56721, CVE-2024-56756, CVE-2024-53171, CVE-2024-49901,\nCVE-2024-53109, CVE-2024-53061, CVE-2024-49929, CVE-2024-47691,\nCVE-2024-50045, CVE-2024-47723, CVE-2024-56546, CVE-2024-50157,\nCVE-2024-53169, CVE-2024-47716, CVE-2024-53093, CVE-2024-50224,\nCVE-2024-53193, CVE-2024-49895, CVE-2024-47698, CVE-2024-49942,\nCVE-2024-50167, CVE-2024-53202, CVE-2024-49870, CVE-2024-50291,\nCVE-2024-50156, CVE-2024-53153, CVE-2024-50272, CVE-2024-50145,\nCVE-2024-50298, CVE-2024-50274, CVE-2024-56694, CVE-2024-50108,\nCVE-2024-50222, CVE-2024-53163, CVE-2024-50164, CVE-2024-53062,\nCVE-2024-50212, CVE-2024-53127, CVE-2024-47688, CVE-2024-49959,\nCVE-2024-50203, CVE-2024-49927, CVE-2024-50083, CVE-2024-53227,\nCVE-2024-47697, CVE-2024-53053, CVE-2024-53172, CVE-2024-56752,\nCVE-2024-50207, CVE-2024-50169, CVE-2024-53176, CVE-2024-53089,\nCVE-2024-56707, CVE-2024-53195, CVE-2024-49851, CVE-2024-53209,\nCVE-2024-49972, CVE-2024-53130, CVE-2024-53157, CVE-2024-53094,\nCVE-2024-50182, CVE-2024-49879, CVE-2024-53191, CVE-2024-49925,\nCVE-2024-49949, CVE-2024-56534, CVE-2024-47714, CVE-2024-53161,\nCVE-2024-49992, CVE-2024-47732, CVE-2024-53143, CVE-2024-53119,\nCVE-2024-50064, CVE-2024-50039, CVE-2024-53087, CVE-2024-49886,\nCVE-2024-49979, CVE-2024-50041, CVE-2024-50184, CVE-2024-49958,\nCVE-2024-50221, CVE-2024-56688, CVE-2024-49941, CVE-2024-50245,\nCVE-2024-50017, CVE-2024-53180, CVE-2024-56535, CVE-2024-50142,\nCVE-2024-50295, CVE-2024-56708, CVE-2024-50016, CVE-2024-49902,\nCVE-2024-50120, CVE-2024-47748, CVE-2024-49982, CVE-2024-50257,\nCVE-2024-50086, CVE-2024-50261, CVE-2024-53188, CVE-2024-49888,\nCVE-2024-53106, CVE-2024-50073, CVE-2024-50186, CVE-2024-56544,\nCVE-2024-47739, CVE-2024-50238, CVE-2024-56739, CVE-2024-49964,\nCVE-2024-47686, CVE-2024-46869, CVE-2024-53116, CVE-2024-50014,\nCVE-2024-53231, CVE-2024-53138, CVE-2024-50213, CVE-2024-50265,\nCVE-2024-49998, CVE-2024-50292, CVE-2024-50137, CVE-2024-50114,\nCVE-2024-53237, CVE-2024-49952, CVE-2024-53074, CVE-2024-49981,\nCVE-2024-47733, CVE-2024-50019, CVE-2024-47719, CVE-2024-53068,\nCVE-2024-49944, CVE-2024-50066, CVE-2024-50007, CVE-2024-53155,\nCVE-2024-47756, CVE-2024-49947, CVE-2024-49951, CVE-2024-50065,\nCVE-2024-49957, CVE-2024-50116, CVE-2024-50188, CVE-2024-50255,\nCVE-2024-53197, CVE-2024-50267, CVE-2024-50124, CVE-2024-53069,\nCVE-2024-53139, CVE-2024-47676, CVE-2024-56545, CVE-2024-53085,\nCVE-2024-50163, CVE-2024-53092, CVE-2024-53099, CVE-2024-49889,\nCVE-2024-53052, CVE-2024-49995, CVE-2024-49976, CVE-2024-50110,\nCVE-2024-50192, CVE-2024-50208, CVE-2024-50276, CVE-2024-53170,\nCVE-2024-50259, CVE-2024-47731, CVE-2024-49924, CVE-2024-56532,\nCVE-2024-50048, CVE-2024-49965, CVE-2024-53147, CVE-2024-50205,\nCVE-2024-49859, CVE-2024-53066, CVE-2024-47687, CVE-2024-50149,\nCVE-2024-49864, CVE-2024-49867, CVE-2024-50160, CVE-2024-53058,\nCVE-2024-47753, CVE-2024-49883, CVE-2024-53199, CVE-2024-56746,\nCVE-2024-50094, CVE-2024-49946, CVE-2024-50006, CVE-2024-53101,\nCVE-2024-49891, CVE-2024-50075, CVE-2024-47747, CVE-2024-47740,\nCVE-2024-50248, CVE-2024-50162, CVE-2024-53090, CVE-2024-53203,\nCVE-2024-50242, CVE-2024-49961, CVE-2024-50085, CVE-2024-50299,\nCVE-2024-49980, CVE-2024-50280, CVE-2024-53107, CVE-2024-50199,\nCVE-2024-53122, CVE-2024-56674, CVE-2024-50079, CVE-2024-50060,\nCVE-2024-53210, CVE-2024-50177, CVE-2024-53223, CVE-2024-50127,\nCVE-2024-53190, CVE-2022-49034, CVE-2024-56744, CVE-2024-50136,\nCVE-2024-47675, CVE-2024-50303, CVE-2024-50123, CVE-2024-47738,\nCVE-2024-50239, CVE-2024-50135, CVE-2024-53218, CVE-2024-50109,\nCVE-2024-56724, CVE-2024-56681, CVE-2024-50027, CVE-2024-50081,\nCVE-2024-50068, CVE-2024-50101, CVE-2024-50071, CVE-2024-50129,\nCVE-2024-50091, CVE-2024-53112, CVE-2024-50181, CVE-2024-50080,\nCVE-2024-47703, CVE-2024-47727, CVE-2024-53215, CVE-2024-53105,\nCVE-2024-50174, CVE-2024-50105, CVE-2024-56700, CVE-2024-53173,\nCVE-2024-49865, CVE-2024-49973, CVE-2024-56538, CVE-2024-50251,\nCVE-2024-56692, CVE-2024-47671, CVE-2024-50189, CVE-2024-49853,\nCVE-2024-50153, CVE-2024-53124, CVE-2024-56549, CVE-2024-53160,\nCVE-2024-53174, CVE-2024-53117, CVE-2024-50279, CVE-2024-50118,\nCVE-2024-47757, CVE-2024-50055, CVE-2024-49875, CVE-2024-50141,\nCVE-2024-49890, CVE-2024-49878, CVE-2024-50134, CVE-2024-53042,\nCVE-2024-56727, CVE-2024-49861, CVE-2024-49948, CVE-2024-50010,\nCVE-2024-49930, CVE-2024-49877, CVE-2024-47690, CVE-2024-50115,\nCVE-2024-50254, CVE-2024-50250, CVE-2024-47679, CVE-2024-50258,\nCVE-2024-53128, CVE-2024-49994, CVE-2024-53154, CVE-2024-50037,\nCVE-2024-53149, CVE-2024-50266, CVE-2024-50061, CVE-2024-56698,\nCVE-2024-53118, CVE-2024-47689, CVE-2024-47708, CVE-2024-50131,\nCVE-2024-50168, CVE-2024-53158, CVE-2024-49894, CVE-2024-50056,\nCVE-2024-50231, CVE-2024-50270, CVE-2024-50269, CVE-2024-50237,\nCVE-2024-56742, CVE-2024-49882, CVE-2024-47749, CVE-2024-49962,\nCVE-2024-49933, CVE-2024-53045, CVE-2024-50028, CVE-2024-53178,\nCVE-2024-50229, CVE-2024-50023, CVE-2024-50161, CVE-2024-56701,\nCVE-2024-49978, CVE-2024-50093, CVE-2024-50195, CVE-2024-49986,\nCVE-2024-53098, CVE-2024-53131, CVE-2024-47684, CVE-2024-53148,\nCVE-2024-50058, CVE-2024-53086, CVE-2024-50113, CVE-2024-49989,\nCVE-2024-50106, CVE-2024-53080, CVE-2024-53229, CVE-2024-50159,\nCVE-2024-56531, CVE-2024-53110, CVE-2024-47736, CVE-2024-56542,\nCVE-2024-47746)\n","status":"published","published":"2025-02-28T11:33:16Z","modified":"2026-11-03T21:17:33.180491814Z","updated_at":"2026-11-03T21:43:54.166508Z"},{"id":"USN-7449-1","title":"linux, linux-aws, linux-azure, linux-azure-6.8, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - RAM backed block device driver;\n  - Compressed RAM block device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - i.MX SoC drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - EROFS file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - UBI file system;\n  - DRM display driver;\n  - BPF subsystem;\n  - StackDepot library;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - DMA mapping infrastructure;\n  - Kernel fork() syscall;\n  - KCSAN framework;\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Task handling mechanism;\n  - Timer subsystem;\n  - KUnit library;\n  - Memory management;\n  - 9P file system network protocol;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Packet sockets;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n(CVE-2024-50288, CVE-2024-56568, CVE-2024-50280, CVE-2024-56677,\nCVE-2024-56620, CVE-2024-53108, CVE-2024-53115, CVE-2024-53061,\nCVE-2024-53215, CVE-2024-50275, CVE-2024-53133, CVE-2024-50279,\nCVE-2025-21831, CVE-2025-21756, CVE-2024-56727, CVE-2024-50208,\nCVE-2024-50142, CVE-2024-53148, CVE-2024-56781, CVE-2024-53171,\nCVE-2024-56608, CVE-2024-53177, CVE-2024-56708, CVE-2024-50207,\nCVE-2024-50278, CVE-2024-50166, CVE-2024-56629, CVE-2024-56723,\nCVE-2024-50172, CVE-2024-56707, CVE-2024-50051, CVE-2024-56606,\nCVE-2024-56700, CVE-2024-56599, CVE-2024-53051, CVE-2024-56632,\nCVE-2024-47143, CVE-2024-53135, CVE-2024-53111, CVE-2024-56634,\nCVE-2024-50262, CVE-2024-56587, CVE-2024-50125, CVE-2024-53145,\nCVE-2024-53185, CVE-2024-56575, CVE-2024-53231, CVE-2024-53072,\nCVE-2024-50110, CVE-2024-53172, CVE-2024-50258, CVE-2024-53226,\nCVE-2024-50211, CVE-2024-43098, CVE-2024-50224, CVE-2024-56642,\nCVE-2024-53082, CVE-2024-50108, CVE-2024-53094, CVE-2024-53184,\nCVE-2024-56648, CVE-2024-50140, CVE-2024-53166, CVE-2024-53090,\nCVE-2024-50301, CVE-2024-56625, CVE-2024-50230, CVE-2024-56586,\nCVE-2024-53052, CVE-2024-56574, CVE-2024-53168, CVE-2024-53209,\nCVE-2024-56640, CVE-2024-49899, CVE-2024-50247, CVE-2024-50150,\nCVE-2024-53058, CVE-2024-50153, CVE-2024-56689, CVE-2024-50283,\nCVE-2024-50251, CVE-2024-56578, CVE-2024-50303, CVE-2024-56569,\nCVE-2024-53134, CVE-2024-50158, CVE-2024-56592, CVE-2024-50300,\nCVE-2024-57838, CVE-2024-50205, CVE-2024-56562, CVE-2024-57843,\nCVE-2024-53084, CVE-2024-56532, CVE-2024-50127, CVE-2024-56584,\nCVE-2024-53196, CVE-2024-56722, CVE-2024-50215, CVE-2022-49034,\nCVE-2024-47809, CVE-2024-56744, CVE-2024-50121, CVE-2024-53083,\nCVE-2024-56540, CVE-2024-50209, CVE-2024-56787, CVE-2024-48873,\nCVE-2024-53221, CVE-2024-56746, CVE-2024-50238, CVE-2024-50226,\nCVE-2024-52332, CVE-2024-56649, CVE-2024-56546, CVE-2024-53223,\nCVE-2024-50259, CVE-2024-50287, CVE-2024-56701, CVE-2024-56692,\nCVE-2024-50243, CVE-2024-53160, CVE-2024-56619, CVE-2024-50128,\nCVE-2024-53173, CVE-2024-53127, CVE-2024-56720, CVE-2024-56633,\nCVE-2024-48875, CVE-2024-56775, CVE-2024-50155, CVE-2024-56611,\nCVE-2024-56539, CVE-2024-50282, CVE-2024-56600, CVE-2024-53110,\nCVE-2024-50111, CVE-2024-56773, CVE-2024-53161, CVE-2024-56615,\nCVE-2024-56786, CVE-2024-56783, CVE-2024-56645, CVE-2024-50216,\nCVE-2024-56605, CVE-2024-56622, CVE-2024-56613, CVE-2024-50245,\nCVE-2024-50240, CVE-2024-53222, CVE-2024-53203, CVE-2024-53042,\nCVE-2024-56724, CVE-2024-57876, CVE-2024-49906, CVE-2024-56596,\nCVE-2024-50234, CVE-2024-41014, CVE-2024-53053, CVE-2024-48881,\nCVE-2024-56601, CVE-2024-56581, CVE-2024-56609, CVE-2024-56576,\nCVE-2024-53044, CVE-2024-53680, CVE-2024-50170, CVE-2024-50116,\nCVE-2024-56705, CVE-2024-53138, CVE-2024-53162, CVE-2024-50136,\nCVE-2024-53210, CVE-2024-50167, CVE-2024-50292, CVE-2024-53067,\nCVE-2024-53101, CVE-2024-56691, CVE-2024-53200, CVE-2024-50255,\nCVE-2024-53142, CVE-2025-21700, CVE-2024-50104, CVE-2024-56687,\nCVE-2024-50163, CVE-2024-56756, CVE-2024-50218, CVE-2024-56550,\nCVE-2024-53202, CVE-2024-50137, CVE-2024-50270, CVE-2024-56641,\nCVE-2024-53154, CVE-2024-53224, CVE-2024-53155, CVE-2024-50124,\nCVE-2024-41935, CVE-2024-50265, CVE-2024-53190, CVE-2024-50256,\nCVE-2024-53234, CVE-2024-56693, CVE-2024-50143, CVE-2024-53181,\nCVE-2024-50154, CVE-2024-53233, CVE-2024-56771, CVE-2024-53236,\nCVE-2024-53227, CVE-2024-56572, CVE-2024-53126, CVE-2024-56551,\nCVE-2024-50299, CVE-2024-53218, CVE-2024-50135, CVE-2024-53188,\nCVE-2024-56635, CVE-2024-53055, CVE-2024-56751, CVE-2024-56577,\nCVE-2024-50289, CVE-2024-56590, CVE-2024-56745, CVE-2024-53176,\nCVE-2024-56681, CVE-2024-50160, CVE-2024-56557, CVE-2024-53213,\nCVE-2024-50267, CVE-2024-50146, CVE-2024-56627, CVE-2024-50290,\nCVE-2024-56565, CVE-2024-56752, CVE-2024-56603, CVE-2024-50246,\nCVE-2024-56690, CVE-2024-50222, CVE-2024-53087, CVE-2024-53091,\nCVE-2024-50115, CVE-2024-53106, CVE-2024-50250, CVE-2024-50242,\nCVE-2024-50248, CVE-2024-53229, CVE-2024-56588, CVE-2024-56785,\nCVE-2024-53195, CVE-2025-21702, CVE-2024-53059, CVE-2024-50107,\nCVE-2024-50139, CVE-2024-50276, CVE-2024-56543, CVE-2024-53228,\nCVE-2024-50232, CVE-2024-53128, CVE-2024-56651, CVE-2024-53047,\nCVE-2024-56726, CVE-2024-50159, CVE-2024-50231, CVE-2024-56545,\nCVE-2024-56778, CVE-2024-56602, CVE-2024-50221, CVE-2024-56754,\nCVE-2024-56704, CVE-2024-56650, CVE-2024-57850, CVE-2024-50206,\nCVE-2024-56573, CVE-2024-56703, CVE-2024-53208, CVE-2024-53158,\nCVE-2024-50274, CVE-2024-56638, CVE-2024-50151, CVE-2024-53239,\nCVE-2024-56742, CVE-2024-50237, CVE-2024-53066, CVE-2024-56580,\nCVE-2024-56688, CVE-2024-53089, CVE-2024-56777, CVE-2024-50138,\nCVE-2024-53198, CVE-2024-56589, CVE-2024-56694, CVE-2024-50261,\nCVE-2024-53147, CVE-2024-50263, CVE-2024-56644, CVE-2024-56597,\nCVE-2024-53197, CVE-2024-50164, CVE-2024-53191, CVE-2024-56549,\nCVE-2024-50284, CVE-2024-57849, CVE-2024-56594, CVE-2024-56782,\nCVE-2024-50235, CVE-2024-49569, CVE-2024-53237, CVE-2024-56643,\nCVE-2024-53109, CVE-2024-53157, CVE-2024-56637, CVE-2024-56623,\nCVE-2024-56683, CVE-2024-50257, CVE-2024-56765, CVE-2024-53201,\nCVE-2024-53050, CVE-2024-53120, CVE-2024-53121, CVE-2024-50126,\nCVE-2024-56774, CVE-2024-53219, CVE-2024-56616, CVE-2024-50223,\nCVE-2024-41932, CVE-2024-50271, CVE-2024-56593, CVE-2024-50285,\nCVE-2024-53113, CVE-2025-21993, CVE-2024-56607, CVE-2024-50252,\nCVE-2024-56610, CVE-2024-53043, CVE-2024-50120, CVE-2024-44955,\nCVE-2024-50118, CVE-2024-53130, CVE-2024-56566, CVE-2024-53146,\nCVE-2024-56721, CVE-2024-53079, CVE-2024-56685, CVE-2024-50145,\nCVE-2024-56755, CVE-2024-50268, CVE-2024-53046, CVE-2024-50010,\nCVE-2024-56531, CVE-2024-53129, CVE-2024-47794, CVE-2024-53119,\nCVE-2024-50297, CVE-2024-56728, CVE-2025-21701, CVE-2024-53163,\nCVE-2024-56739, CVE-2024-56538, CVE-2024-50294, CVE-2024-53183,\nCVE-2024-53131, CVE-2024-56626, CVE-2024-50133, CVE-2024-53151,\nCVE-2024-56679, CVE-2024-50225, CVE-2024-50152, CVE-2024-53174,\nCVE-2024-56698, CVE-2024-53105, CVE-2024-53085, CVE-2024-53220,\nCVE-2024-53180, CVE-2024-53060, CVE-2024-53139, CVE-2024-56631,\nCVE-2024-53175, CVE-2024-57872, CVE-2024-56779, CVE-2024-50220,\nCVE-2024-50169, CVE-2024-56772, CVE-2024-53230, CVE-2024-53122,\nCVE-2024-50067, CVE-2024-56558, CVE-2024-45828, CVE-2024-57874,\nCVE-2024-50239, CVE-2024-53214, CVE-2024-56621, CVE-2024-50156,\nCVE-2024-56583, CVE-2024-56776, CVE-2024-50298, CVE-2024-56533,\nCVE-2024-56748, CVE-2024-53114, CVE-2024-53187, CVE-2024-50269,\nCVE-2024-50286, CVE-2024-56579, CVE-2024-56548, CVE-2024-50210,\nCVE-2024-50244, CVE-2024-50291, CVE-2024-56567, CVE-2024-56780,\nCVE-2024-53150, CVE-2024-56636, CVE-2024-56561, CVE-2024-53194,\nCVE-2024-53093, CVE-2024-53117, CVE-2024-53062, CVE-2024-53123,\nCVE-2024-50236, CVE-2024-56630, CVE-2024-56678, CVE-2024-48876,\nCVE-2024-50249, CVE-2024-53099, CVE-2024-53048, CVE-2024-50296,\nCVE-2024-50131, CVE-2024-50105, CVE-2024-50141, CVE-2024-56729,\nCVE-2024-53217, CVE-2024-50295, CVE-2024-50130, CVE-2024-56725,\nCVE-2024-42122, CVE-2024-56570, CVE-2024-53118, CVE-2024-50112,\nCVE-2024-50203, CVE-2024-53178, CVE-2024-53068, CVE-2024-50272,\nCVE-2024-53232, CVE-2024-53088, CVE-2024-56647, CVE-2024-53076,\nCVE-2024-53100, CVE-2024-53096, CVE-2024-56747, CVE-2024-53045,\nCVE-2024-53086, CVE-2024-50147, CVE-2024-53081, CVE-2024-50273,\nCVE-2024-50103, CVE-2024-53107, CVE-2024-53095, CVE-2024-47141,\nCVE-2024-56604, CVE-2024-50304, CVE-2024-53169, CVE-2024-50162,\nCVE-2024-53112)\n","status":"published","published":"2025-04-23T14:20:38Z","modified":"2026-11-03T21:19:53.332188631Z","updated_at":"2026-11-03T21:42:57.147559Z"},{"id":"USN-7449-2","title":"linux-hwe-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - RAM backed block device driver;\n  - Compressed RAM block device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - i.MX SoC drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - EROFS file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - UBI file system;\n  - DRM display driver;\n  - BPF subsystem;\n  - StackDepot library;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - DMA mapping infrastructure;\n  - Kernel fork() syscall;\n  - KCSAN framework;\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Task handling mechanism;\n  - Timer subsystem;\n  - KUnit library;\n  - Memory management;\n  - 9P file system network protocol;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Packet sockets;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n(CVE-2022-49034, CVE-2024-56632, CVE-2024-53177, CVE-2024-56679,\nCVE-2024-48881, CVE-2024-56690, CVE-2024-50216, CVE-2024-50269,\nCVE-2024-53079, CVE-2024-50111, CVE-2024-50103, CVE-2024-50147,\nCVE-2024-53089, CVE-2024-56579, CVE-2024-53110, CVE-2024-50203,\nCVE-2024-50243, CVE-2024-57872, CVE-2024-53181, CVE-2024-50155,\nCVE-2024-53196, CVE-2024-50154, CVE-2024-53084, CVE-2024-50128,\nCVE-2024-53146, CVE-2024-53047, CVE-2024-56619, CVE-2024-50259,\nCVE-2024-56724, CVE-2024-50270, CVE-2024-44955, CVE-2024-53166,\nCVE-2024-56771, CVE-2024-53081, CVE-2024-50172, CVE-2024-56636,\nCVE-2024-56543, CVE-2024-49906, CVE-2024-45828, CVE-2024-50236,\nCVE-2024-50284, CVE-2024-56694, CVE-2024-56777, CVE-2024-50296,\nCVE-2024-53083, CVE-2024-50299, CVE-2024-53117, CVE-2024-53202,\nCVE-2024-53052, CVE-2024-53145, CVE-2024-53106, CVE-2024-50121,\nCVE-2024-53113, CVE-2024-50300, CVE-2024-50211, CVE-2024-50226,\nCVE-2024-50230, CVE-2024-56698, CVE-2024-53184, CVE-2024-50142,\nCVE-2024-56638, CVE-2024-53043, CVE-2024-56651, CVE-2024-50105,\nCVE-2024-56549, CVE-2024-56644, CVE-2024-50303, CVE-2024-53108,\nCVE-2024-53221, CVE-2024-56576, CVE-2024-50248, CVE-2024-50222,\nCVE-2024-53150, CVE-2024-50287, CVE-2024-53045, CVE-2024-53213,\nCVE-2024-50127, CVE-2024-53129, CVE-2024-53217, CVE-2024-53130,\nCVE-2024-56640, CVE-2024-56634, CVE-2024-53169, CVE-2024-53200,\nCVE-2024-53151, CVE-2024-53087, CVE-2024-53050, CVE-2024-53237,\nCVE-2024-50159, CVE-2024-43098, CVE-2025-21831, CVE-2024-52332,\nCVE-2024-53220, CVE-2024-50138, CVE-2024-53115, CVE-2024-50152,\nCVE-2024-56703, CVE-2024-53168, CVE-2024-53123, CVE-2024-50271,\nCVE-2024-50210, CVE-2024-50275, CVE-2024-50153, CVE-2024-50301,\nCVE-2024-56601, CVE-2024-47141, CVE-2024-56649, CVE-2024-50133,\nCVE-2024-56772, CVE-2024-50249, CVE-2024-50118, CVE-2024-56562,\nCVE-2024-53197, CVE-2024-56566, CVE-2024-56725, CVE-2024-56603,\nCVE-2024-56621, CVE-2024-50292, CVE-2024-56561, CVE-2024-53139,\nCVE-2024-56575, CVE-2024-53155, CVE-2024-53048, CVE-2024-50272,\nCVE-2024-53119, CVE-2024-53215, CVE-2024-53172, CVE-2024-50279,\nCVE-2024-56739, CVE-2024-56700, CVE-2024-53135, CVE-2024-50252,\nCVE-2024-56688, CVE-2024-41014, CVE-2024-56604, CVE-2024-53099,\nCVE-2024-56701, CVE-2024-56532, CVE-2024-53222, CVE-2024-56533,\nCVE-2024-56787, CVE-2024-53121, CVE-2024-53053, CVE-2024-50206,\nCVE-2024-53091, CVE-2024-50208, CVE-2024-53134, CVE-2024-56568,\nCVE-2024-53183, CVE-2024-56780, CVE-2024-53194, CVE-2024-56586,\nCVE-2024-53127, CVE-2024-50263, CVE-2024-56776, CVE-2024-53208,\nCVE-2024-50273, CVE-2024-53178, CVE-2024-53214, CVE-2024-50282,\nCVE-2024-50245, CVE-2024-56616, CVE-2024-50145, CVE-2024-50235,\nCVE-2024-50276, CVE-2024-50110, CVE-2024-56748, CVE-2024-56558,\nCVE-2024-53122, CVE-2024-50162, CVE-2024-53131, CVE-2024-50120,\nCVE-2024-56627, CVE-2024-53076, CVE-2024-53228, CVE-2024-53058,\nCVE-2024-53201, CVE-2024-50267, CVE-2024-50104, CVE-2024-53109,\nCVE-2024-56565, CVE-2024-56574, CVE-2024-53231, CVE-2024-56631,\nCVE-2024-56625, CVE-2024-53093, CVE-2024-53051, CVE-2024-50151,\nCVE-2024-53198, CVE-2024-50156, CVE-2024-50244, CVE-2024-53062,\nCVE-2024-56588, CVE-2024-53095, CVE-2024-53142, CVE-2024-53210,\nCVE-2024-53120, CVE-2024-50265, CVE-2024-53185, CVE-2024-56590,\nCVE-2024-50108, CVE-2024-50220, CVE-2024-56756, CVE-2024-56635,\nCVE-2024-50304, CVE-2024-56545, CVE-2024-57849, CVE-2024-56708,\nCVE-2024-53157, CVE-2024-50250, CVE-2024-56678, CVE-2024-57874,\nCVE-2024-53114, CVE-2024-53160, CVE-2024-56723, CVE-2024-56683,\nCVE-2024-56570, CVE-2024-53209, CVE-2024-53126, CVE-2024-56581,\nCVE-2024-53161, CVE-2024-56605, CVE-2024-50115, CVE-2024-50135,\nCVE-2024-53061, CVE-2024-50126, CVE-2024-56573, CVE-2024-56567,\nCVE-2024-56546, CVE-2024-53180, CVE-2024-50283, CVE-2024-50207,\nCVE-2024-50242, CVE-2024-50240, CVE-2024-50130, CVE-2024-47794,\nCVE-2024-56611, CVE-2024-56751, CVE-2024-53138, CVE-2024-53195,\nCVE-2024-47143, CVE-2024-56691, CVE-2025-21702, CVE-2024-56742,\nCVE-2024-53223, CVE-2024-53227, CVE-2024-50150, CVE-2024-56594,\nCVE-2024-50140, CVE-2024-56721, CVE-2024-53059, CVE-2024-41932,\nCVE-2024-41935, CVE-2024-56607, CVE-2024-53191, CVE-2024-53055,\nCVE-2024-50218, CVE-2024-56746, CVE-2024-53096, CVE-2024-56531,\nCVE-2024-57876, CVE-2024-56592, CVE-2024-56722, CVE-2024-56728,\nCVE-2025-21700, CVE-2024-53232, CVE-2024-56608, CVE-2024-53190,\nCVE-2024-56752, CVE-2024-50234, CVE-2024-56572, CVE-2024-53044,\nCVE-2024-50107, CVE-2024-56677, CVE-2024-53111, CVE-2024-50205,\nCVE-2024-56650, CVE-2024-48875, CVE-2024-56609, CVE-2024-53680,\nCVE-2024-56687, CVE-2024-53175, CVE-2024-50231, CVE-2024-56578,\nCVE-2024-50112, CVE-2024-56647, CVE-2024-50294, CVE-2024-50160,\nCVE-2024-50209, CVE-2024-53147, CVE-2024-56707, CVE-2024-53088,\nCVE-2024-50167, CVE-2024-50232, CVE-2024-56642, CVE-2024-56596,\nCVE-2024-50224, CVE-2024-53100, CVE-2024-50137, CVE-2024-56633,\nCVE-2024-56580, CVE-2024-53118, CVE-2024-53082, CVE-2024-56569,\nCVE-2024-56775, CVE-2024-53173, CVE-2024-56727, CVE-2024-56597,\nCVE-2024-56593, CVE-2024-56744, CVE-2024-53105, CVE-2024-56786,\nCVE-2024-53224, CVE-2024-53162, CVE-2024-57838, CVE-2024-50223,\nCVE-2024-50139, CVE-2024-56557, CVE-2024-50221, CVE-2024-50124,\nCVE-2024-50251, CVE-2024-50170, CVE-2024-53230, CVE-2024-53148,\nCVE-2024-56623, CVE-2024-50125, CVE-2024-53094, CVE-2024-50136,\nCVE-2024-50288, CVE-2024-50131, CVE-2024-56689, CVE-2024-56610,\nCVE-2024-53066, CVE-2024-56641, CVE-2024-50067, CVE-2024-53174,\nCVE-2024-53236, CVE-2024-56785, CVE-2024-56637, CVE-2024-56765,\nCVE-2024-50255, CVE-2024-53187, CVE-2024-56643, CVE-2024-56540,\nCVE-2024-50261, CVE-2024-56630, CVE-2024-50169, CVE-2024-50010,\nCVE-2024-53128, CVE-2024-56551, CVE-2024-53090, CVE-2024-56773,\nCVE-2025-21701, CVE-2024-50262, CVE-2024-56648, CVE-2024-56779,\nCVE-2024-50278, CVE-2024-53086, CVE-2024-48873, CVE-2024-56745,\nCVE-2024-50247, CVE-2024-56602, CVE-2024-53085, CVE-2024-50238,\nCVE-2024-56726, CVE-2024-50256, CVE-2024-49899, CVE-2024-50239,\nCVE-2024-50166, CVE-2024-56629, CVE-2024-50225, CVE-2024-53060,\nCVE-2024-53046, CVE-2025-21756, CVE-2024-50051, CVE-2024-50258,\nCVE-2024-50297, CVE-2024-53203, CVE-2024-50257, CVE-2024-56577,\nCVE-2024-50116, CVE-2024-53226, CVE-2024-47809, CVE-2024-50280,\nCVE-2024-53229, CVE-2024-50290, CVE-2024-56600, CVE-2024-50143,\nCVE-2024-53171, CVE-2024-53163, CVE-2024-56704, CVE-2024-50274,\nCVE-2024-53072, CVE-2024-50141, CVE-2024-48876, CVE-2024-56681,\nCVE-2024-56599, CVE-2024-56774, CVE-2024-56583, CVE-2024-50146,\nCVE-2024-56729, CVE-2024-50295, CVE-2024-56693, CVE-2024-53158,\nCVE-2024-56548, CVE-2024-53154, CVE-2024-53188, CVE-2024-50237,\nCVE-2024-56550, CVE-2024-53233, CVE-2024-53068, CVE-2024-56783,\nCVE-2024-50164, CVE-2024-53067, CVE-2024-50298, CVE-2024-50285,\nCVE-2024-50246, CVE-2024-42122, CVE-2024-56754, CVE-2024-56606,\nCVE-2024-53101, CVE-2024-56626, CVE-2024-56589, CVE-2024-56692,\nCVE-2024-53234, CVE-2024-56613, CVE-2024-53133, CVE-2024-56747,\nCVE-2024-57843, CVE-2024-50215, CVE-2024-56705, CVE-2024-56620,\nCVE-2024-56615, CVE-2024-56539, CVE-2024-57850, CVE-2024-56755,\nCVE-2024-56584, CVE-2024-50291, CVE-2024-53218, CVE-2024-56685,\nCVE-2024-50158, CVE-2024-56782, CVE-2024-53176, CVE-2024-53042,\nCVE-2024-50268, CVE-2024-53239, CVE-2024-50286, CVE-2024-53107,\nCVE-2024-56645, CVE-2024-56538, CVE-2024-56622, CVE-2024-56720,\nCVE-2024-50163, CVE-2025-21993, CVE-2024-53219, CVE-2024-56587,\nCVE-2024-56781, CVE-2024-49569, CVE-2024-50289, CVE-2024-53112,\nCVE-2024-56778)\n","status":"published","published":"2025-04-24T17:43:48Z","modified":"2026-11-03T21:17:31.484740669Z","updated_at":"2026-11-03T21:43:54.166508Z"},{"id":"USN-7450-1","title":"linux-gcp, linux-gke, linux-gkeop vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - RAM backed block device driver;\n  - Compressed RAM block device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - i.MX SoC drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - EROFS file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - UBI file system;\n  - DRM display driver;\n  - BPF subsystem;\n  - StackDepot library;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - DMA mapping infrastructure;\n  - Kernel fork() syscall;\n  - KCSAN framework;\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Task handling mechanism;\n  - Timer subsystem;\n  - KUnit library;\n  - Memory management;\n  - 9P file system network protocol;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Packet sockets;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n(CVE-2024-50051, CVE-2024-56546, CVE-2024-56551, CVE-2024-53236,\nCVE-2024-50244, CVE-2024-53043, CVE-2024-56694, CVE-2025-21700,\nCVE-2024-56700, CVE-2025-21993, CVE-2024-53224, CVE-2024-50105,\nCVE-2024-53100, CVE-2024-56690, CVE-2024-50150, CVE-2024-53223,\nCVE-2024-50285, CVE-2024-50269, CVE-2024-53089, CVE-2024-53044,\nCVE-2024-53175, CVE-2024-57849, CVE-2024-50296, CVE-2024-50120,\nCVE-2024-50147, CVE-2024-56540, CVE-2024-56602, CVE-2024-50289,\nCVE-2024-53127, CVE-2024-56786, CVE-2024-50108, CVE-2024-53045,\nCVE-2024-53067, CVE-2024-50138, CVE-2024-53173, CVE-2024-50143,\nCVE-2024-56678, CVE-2024-53130, CVE-2024-53157, CVE-2024-56723,\nCVE-2024-56623, CVE-2024-53234, CVE-2024-53088, CVE-2024-53068,\nCVE-2024-53195, CVE-2024-53188, CVE-2024-56613, CVE-2024-56561,\nCVE-2024-53218, CVE-2024-50215, CVE-2024-53227, CVE-2024-50139,\nCVE-2024-50170, CVE-2024-56640, CVE-2024-56720, CVE-2024-56780,\nCVE-2024-56705, CVE-2024-53131, CVE-2024-56597, CVE-2024-50224,\nCVE-2024-57843, CVE-2024-50251, CVE-2024-50243, CVE-2024-53200,\nCVE-2024-50280, CVE-2024-50303, CVE-2024-50107, CVE-2024-56606,\nCVE-2024-53237, CVE-2024-53161, CVE-2024-56685, CVE-2024-53185,\nCVE-2024-56785, CVE-2024-53150, CVE-2024-53166, CVE-2024-50141,\nCVE-2024-50158, CVE-2024-47143, CVE-2024-56773, CVE-2024-53090,\nCVE-2024-56778, CVE-2024-50142, CVE-2025-21701, CVE-2024-50301,\nCVE-2024-53050, CVE-2024-50211, CVE-2024-50246, CVE-2024-50252,\nCVE-2024-53122, CVE-2024-53085, CVE-2024-50104, CVE-2024-50288,\nCVE-2024-53151, CVE-2024-56728, CVE-2024-53086, CVE-2024-56568,\nCVE-2024-53133, CVE-2024-50290, CVE-2024-56774, CVE-2024-50278,\nCVE-2024-56565, CVE-2024-53147, CVE-2024-56775, CVE-2024-53239,\nCVE-2024-56533, CVE-2024-50225, CVE-2024-50124, CVE-2024-47794,\nCVE-2024-50163, CVE-2024-53680, CVE-2024-56574, CVE-2024-56605,\nCVE-2024-50112, CVE-2024-53221, CVE-2024-56751, CVE-2024-56538,\nCVE-2024-53123, CVE-2024-56688, CVE-2024-50239, CVE-2024-56742,\nCVE-2024-56752, CVE-2024-53059, CVE-2024-50282, CVE-2024-50238,\nCVE-2024-53108, CVE-2024-50152, CVE-2024-53214, CVE-2024-53226,\nCVE-2024-50292, CVE-2024-56580, CVE-2024-56621, CVE-2024-56593,\nCVE-2024-56689, CVE-2024-56649, CVE-2024-56650, CVE-2024-53203,\nCVE-2024-56626, CVE-2025-21831, CVE-2024-53053, CVE-2024-50257,\nCVE-2024-50203, CVE-2024-56643, CVE-2024-50231, CVE-2024-53066,\nCVE-2024-53105, CVE-2024-53233, CVE-2024-56703, CVE-2024-56725,\nCVE-2024-50172, CVE-2024-53160, CVE-2024-50131, CVE-2024-53196,\nCVE-2024-56645, CVE-2024-50304, CVE-2024-56746, CVE-2024-53232,\nCVE-2024-49906, CVE-2024-53129, CVE-2024-53135, CVE-2024-56545,\nCVE-2024-56600, CVE-2024-56642, CVE-2024-43098, CVE-2024-50291,\nCVE-2024-53219, CVE-2024-53197, CVE-2024-53084, CVE-2024-53155,\nCVE-2024-53094, CVE-2024-56581, CVE-2024-56531, CVE-2024-50300,\nCVE-2024-50232, CVE-2024-56590, CVE-2024-48881, CVE-2024-56708,\nCVE-2024-56632, CVE-2024-53051, CVE-2024-53177, CVE-2024-56698,\nCVE-2024-56707, CVE-2024-56693, CVE-2024-53213, CVE-2024-53121,\nCVE-2024-56681, CVE-2024-56607, CVE-2024-53120, CVE-2024-56615,\nCVE-2024-53109, CVE-2024-50209, CVE-2024-56592, CVE-2024-50103,\nCVE-2024-56722, CVE-2024-53046, CVE-2024-50155, CVE-2024-56765,\nCVE-2024-56572, CVE-2024-56611, CVE-2024-56679, CVE-2024-50259,\nCVE-2024-50111, CVE-2024-53217, CVE-2024-53113, CVE-2024-53101,\nCVE-2024-50208, CVE-2024-53115, CVE-2024-56691, CVE-2024-50137,\nCVE-2024-53194, CVE-2024-41935, CVE-2024-56584, CVE-2022-49034,\nCVE-2024-53072, CVE-2024-41932, CVE-2024-56729, CVE-2024-53095,\nCVE-2024-56755, CVE-2024-50268, CVE-2024-56631, CVE-2024-48875,\nCVE-2025-21756, CVE-2024-50127, CVE-2024-50136, CVE-2024-56562,\nCVE-2024-56683, CVE-2024-50250, CVE-2024-53184, CVE-2024-50205,\nCVE-2024-56543, CVE-2024-56787, CVE-2024-50116, CVE-2024-53096,\nCVE-2024-53169, CVE-2024-50154, CVE-2024-53230, CVE-2024-50247,\nCVE-2024-56570, CVE-2024-56583, CVE-2025-21702, CVE-2024-50126,\nCVE-2024-50151, CVE-2024-53208, CVE-2024-50153, CVE-2024-56619,\nCVE-2024-56532, CVE-2024-56776, CVE-2024-53093, CVE-2024-53139,\nCVE-2024-50263, CVE-2024-41014, CVE-2024-53126, CVE-2024-53052,\nCVE-2024-56636, CVE-2024-50299, CVE-2024-56601, CVE-2024-56569,\nCVE-2024-53168, CVE-2024-53112, CVE-2024-56576, CVE-2024-50230,\nCVE-2024-56630, CVE-2024-50010, CVE-2024-56599, CVE-2024-50156,\nCVE-2024-50286, CVE-2024-53174, CVE-2024-50216, CVE-2024-56744,\nCVE-2024-50265, CVE-2024-50255, CVE-2024-56567, CVE-2024-50118,\nCVE-2024-50276, CVE-2024-53099, CVE-2024-50234, CVE-2024-56745,\nCVE-2024-53114, CVE-2024-50273, CVE-2024-49899, CVE-2024-56608,\nCVE-2024-56625, CVE-2024-56577, CVE-2024-56596, CVE-2024-56634,\nCVE-2024-56777, CVE-2024-47141, CVE-2024-53180, CVE-2024-56701,\nCVE-2024-53158, CVE-2024-56566, CVE-2024-56616, CVE-2024-53117,\nCVE-2024-53181, CVE-2024-50115, CVE-2024-56772, CVE-2024-53163,\nCVE-2024-50140, CVE-2024-56633, CVE-2024-50262, CVE-2024-56677,\nCVE-2024-53201, CVE-2024-57850, CVE-2024-50271, CVE-2024-50279,\nCVE-2024-50226, CVE-2024-53191, CVE-2024-45828, CVE-2024-53106,\nCVE-2024-50275, CVE-2024-50245, CVE-2024-56783, CVE-2024-50261,\nCVE-2024-50283, CVE-2024-53062, CVE-2024-50240, CVE-2024-53183,\nCVE-2024-53222, CVE-2024-53119, CVE-2024-53138, CVE-2024-52332,\nCVE-2024-50167, CVE-2024-53042, CVE-2024-50169, CVE-2024-50162,\nCVE-2024-53087, CVE-2024-50298, CVE-2024-56610, CVE-2024-53060,\nCVE-2024-56578, CVE-2024-50272, CVE-2024-56604, CVE-2024-50287,\nCVE-2024-47809, CVE-2024-56603, CVE-2024-50237, CVE-2024-56647,\nCVE-2024-56747, CVE-2024-50221, CVE-2024-53215, CVE-2024-56550,\nCVE-2024-56748, CVE-2024-56557, CVE-2024-48873, CVE-2024-49569,\nCVE-2024-50206, CVE-2024-56781, CVE-2024-56638, CVE-2024-50218,\nCVE-2024-53055, CVE-2024-57838, CVE-2024-50267, CVE-2024-56575,\nCVE-2024-53202, CVE-2024-53154, CVE-2024-53176, CVE-2024-56779,\nCVE-2024-50210, CVE-2024-56589, CVE-2024-50130, CVE-2024-53190,\nCVE-2024-53082, CVE-2024-56549, CVE-2024-56594, CVE-2024-50294,\nCVE-2024-56754, CVE-2024-53142, CVE-2024-50295, CVE-2024-57872,\nCVE-2024-53081, CVE-2024-56629, CVE-2024-53209, CVE-2024-56558,\nCVE-2024-50164, CVE-2024-53162, CVE-2024-56539, CVE-2024-56721,\nCVE-2024-50121, CVE-2024-56651, CVE-2024-56609, CVE-2024-50207,\nCVE-2024-50220, CVE-2024-53228, CVE-2024-53171, CVE-2024-53110,\nCVE-2024-53146, CVE-2024-53148, CVE-2024-50284, CVE-2024-56739,\nCVE-2024-48876, CVE-2024-50222, CVE-2024-53079, CVE-2024-53048,\nCVE-2024-50135, CVE-2024-56726, CVE-2024-50110, CVE-2024-53145,\nCVE-2024-53198, CVE-2024-50249, CVE-2024-44955, CVE-2024-56573,\nCVE-2024-53047, CVE-2024-50133, CVE-2024-53091, CVE-2024-53134,\nCVE-2024-50128, CVE-2024-56648, CVE-2024-53111, CVE-2024-50258,\nCVE-2024-56587, CVE-2024-56644, CVE-2024-53229, CVE-2024-56727,\nCVE-2024-50159, CVE-2024-57874, CVE-2024-50166, CVE-2024-53210,\nCVE-2024-53172, CVE-2024-53107, CVE-2024-56620, CVE-2024-53076,\nCVE-2024-50236, CVE-2024-56627, CVE-2024-56771, CVE-2024-56724,\nCVE-2024-50235, CVE-2024-50270, CVE-2024-50160, CVE-2024-50067,\nCVE-2024-56641, CVE-2024-50297, CVE-2024-53178, CVE-2024-53231,\nCVE-2024-56692, CVE-2024-53128, CVE-2024-56635, CVE-2024-42122,\nCVE-2024-50223, CVE-2024-56586, CVE-2024-50242, CVE-2024-50256,\nCVE-2024-56756, CVE-2024-56782, CVE-2024-50145, CVE-2024-56704,\nCVE-2024-50146, CVE-2024-53058, CVE-2024-56588, CVE-2024-53187,\nCVE-2024-56548, CVE-2024-56579, CVE-2024-50248, CVE-2024-50125,\nCVE-2024-57876, CVE-2024-56687, CVE-2024-53061, CVE-2024-53118,\nCVE-2024-56622, CVE-2024-53083, CVE-2024-53220, CVE-2024-56637)\n","status":"published","published":"2025-04-23T14:50:25Z","modified":"2026-11-03T21:18:00.636291983Z","updated_at":"2026-11-03T21:43:48.662011Z"},{"id":"USN-7451-1","title":"linux-aws-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - RAM backed block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DAX dirext access to differentiated memory framework;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NTB driver;\n  - Virtio pmem driver;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - SuperH / SH-Mobile drivers;\n  - i.MX SoC drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Direct Digital Synthesis drivers;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - TI TPS6598x USB Power Delivery controller driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - UBI file system;\n  - DRM display driver;\n  - BPF subsystem;\n  - Network file system (NFS) superblock;\n  - StackDepot library;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network namespace;\n  - Netfilter;\n  - Network traffic control;\n  - Network sockets;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - DMA mapping infrastructure;\n  - Kernel fork() syscall;\n  - KCSAN framework;\n  - Kernel thread helper (kthread);\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Task handling mechanism;\n  - Timer subsystem;\n  - KUnit library;\n  - Maple Tree data structure library;\n  - Memory management;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - Packet sockets;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n(CVE-2024-49914, CVE-2024-53158, CVE-2024-50225, CVE-2024-50224,\nCVE-2024-53139, CVE-2024-56720, CVE-2024-53680, CVE-2024-56650,\nCVE-2024-53113, CVE-2024-53138, CVE-2024-53131, CVE-2024-56614,\nCVE-2024-56586, CVE-2024-50095, CVE-2024-56578, CVE-2024-50131,\nCVE-2024-56748, CVE-2024-50280, CVE-2024-56637, CVE-2024-57850,\nCVE-2024-56651, CVE-2024-52332, CVE-2024-56707, CVE-2024-53166,\nCVE-2024-47794, CVE-2024-53118, CVE-2024-50099, CVE-2024-53089,\nCVE-2024-50216, CVE-2024-50292, CVE-2024-53047, CVE-2024-56627,\nCVE-2024-50108, CVE-2024-50289, CVE-2024-56672, CVE-2024-50291,\nCVE-2024-56785, CVE-2024-53119, CVE-2024-50152, CVE-2024-56589,\nCVE-2024-50229, CVE-2024-53221, CVE-2024-53157, CVE-2024-50201,\nCVE-2024-56679, CVE-2024-50125, CVE-2024-56701, CVE-2024-50128,\nCVE-2024-53230, CVE-2024-56576, CVE-2024-50215, CVE-2024-56606,\nCVE-2024-50146, CVE-2024-50272, CVE-2024-53233, CVE-2024-56782,\nCVE-2024-50009, CVE-2024-56604, CVE-2024-50258, CVE-2024-50140,\nCVE-2024-50232, CVE-2024-53107, CVE-2024-50218, CVE-2024-50221,\nCVE-2024-50143, CVE-2024-56739, CVE-2024-53201, CVE-2024-50130,\nCVE-2024-50141, CVE-2024-53134, CVE-2024-53173, CVE-2024-50063,\nCVE-2024-53060, CVE-2024-53093, CVE-2024-50162, CVE-2024-50111,\nCVE-2024-50153, CVE-2024-53198, CVE-2024-50039, CVE-2024-50180,\nCVE-2024-56568, CVE-2024-56746, CVE-2024-50263, CVE-2024-56575,\nCVE-2024-50040, CVE-2024-56681, CVE-2024-50210, CVE-2024-56566,\nCVE-2024-56611, CVE-2024-53188, CVE-2024-56641, CVE-2024-50240,\nCVE-2024-50252, CVE-2024-56603, CVE-2024-56539, CVE-2024-53187,\nCVE-2024-50223, CVE-2024-53117, CVE-2024-50268, CVE-2024-49921,\nCVE-2024-57876, CVE-2024-56579, CVE-2024-49972, CVE-2024-50239,\nCVE-2024-50148, CVE-2024-50078, CVE-2024-50061, CVE-2024-56626,\nCVE-2024-50286, CVE-2024-56543, CVE-2024-50088, CVE-2024-50069,\nCVE-2024-41935, CVE-2024-57843, CVE-2024-53059, CVE-2024-56605,\nCVE-2024-53234, CVE-2024-53121, CVE-2024-56772, CVE-2024-53120,\nCVE-2024-50171, CVE-2024-56780, CVE-2024-47143, CVE-2024-50065,\nCVE-2024-50124, CVE-2024-56691, CVE-2024-50056, CVE-2024-56645,\nCVE-2024-53200, CVE-2024-50295, CVE-2024-56551, CVE-2024-56565,\nCVE-2024-50118, CVE-2024-50206, CVE-2024-50116, CVE-2024-56545,\nCVE-2024-50211, CVE-2024-50025, CVE-2024-53129, CVE-2024-49569,\nCVE-2024-56781, CVE-2024-56574, CVE-2024-50244, CVE-2024-50103,\nCVE-2024-50112, CVE-2024-47726, CVE-2024-53154, CVE-2024-53090,\nCVE-2024-50064, CVE-2024-50231, CVE-2024-56572, CVE-2024-56649,\nCVE-2024-50195, CVE-2024-49899, CVE-2024-53050, CVE-2024-53063,\nCVE-2025-21702, CVE-2024-50233, CVE-2024-49920, CVE-2024-44955,\nCVE-2024-50049, CVE-2024-50087, CVE-2024-56631, CVE-2024-50196,\nCVE-2024-50183, CVE-2024-50115, CVE-2024-53148, CVE-2024-53083,\nCVE-2024-50220, CVE-2024-53076, CVE-2024-50075, CVE-2024-53171,\nCVE-2024-50237, CVE-2024-50251, CVE-2024-50245, CVE-2024-56581,\nCVE-2024-50032, CVE-2024-56642, CVE-2024-50051, CVE-2024-56635,\nCVE-2024-56596, CVE-2024-56726, CVE-2024-57798, CVE-2024-50235,\nCVE-2024-50248, CVE-2024-53237, CVE-2024-50120, CVE-2024-56629,\nCVE-2024-56776, CVE-2024-47809, CVE-2024-50024, CVE-2024-50189,\nCVE-2024-50283, CVE-2024-53160, CVE-2024-50304, CVE-2024-53178,\nCVE-2024-56698, CVE-2024-50090, CVE-2024-50070, CVE-2025-21701,\nCVE-2024-53126, CVE-2024-53087, CVE-2024-56773, CVE-2024-50194,\nCVE-2024-56561, CVE-2024-50154, CVE-2024-50158, CVE-2024-50147,\nCVE-2024-53133, CVE-2024-50187, CVE-2024-53180, CVE-2024-50279,\nCVE-2024-49893, CVE-2024-50138, CVE-2024-53066, CVE-2024-50242,\nCVE-2024-47141, CVE-2024-53115, CVE-2024-50059, CVE-2024-56540,\nCVE-2024-53220, CVE-2024-50288, CVE-2024-57874, CVE-2024-50026,\nCVE-2024-56689, CVE-2024-50042, CVE-2024-49865, CVE-2024-50047,\nCVE-2024-50164, CVE-2024-56549, CVE-2024-56765, CVE-2024-56587,\nCVE-2024-56567, CVE-2024-48875, CVE-2024-56570, CVE-2024-50126,\nCVE-2024-53140, CVE-2024-50167, CVE-2024-57872, CVE-2024-53055,\nCVE-2024-56745, CVE-2024-56633, CVE-2024-53108, CVE-2024-53150,\nCVE-2024-53174, CVE-2024-50077, CVE-2024-56747, CVE-2024-50294,\nCVE-2024-53091, CVE-2024-56742, CVE-2024-56573, CVE-2024-50270,\nCVE-2024-50028, CVE-2024-50285, CVE-2024-56694, CVE-2024-50274,\nCVE-2024-50222, CVE-2024-56634, CVE-2024-50027, CVE-2024-56562,\nCVE-2024-50066, CVE-2024-50301, CVE-2024-53231, CVE-2024-56538,\nCVE-2024-53044, CVE-2024-53106, CVE-2024-41014, CVE-2024-50202,\nCVE-2024-56583, CVE-2024-50267, CVE-2024-53219, CVE-2024-50298,\nCVE-2024-47711, CVE-2024-53048, CVE-2024-56602, CVE-2024-50048,\nCVE-2024-56598, CVE-2024-53105, CVE-2024-53072, CVE-2024-53094,\nCVE-2024-50137, CVE-2024-50269, CVE-2024-53109, CVE-2024-56755,\nCVE-2024-53208, CVE-2024-53165, CVE-2024-56724, CVE-2024-56774,\nCVE-2024-53202, CVE-2024-56752, CVE-2024-53228, CVE-2024-56532,\nCVE-2024-53147, CVE-2024-56582, CVE-2024-56723, CVE-2024-56778,\nCVE-2024-50096, CVE-2024-56599, CVE-2024-56632, CVE-2024-53191,\nCVE-2024-56616, CVE-2024-50080, CVE-2025-21993, CVE-2024-56647,\nCVE-2024-56648, CVE-2024-56722, CVE-2024-53176, CVE-2024-50234,\nCVE-2024-50256, CVE-2024-53145, CVE-2024-50182, CVE-2024-50160,\nCVE-2024-53123, CVE-2024-53227, CVE-2024-50020, CVE-2024-56644,\nCVE-2024-50045, CVE-2024-50036, CVE-2024-56783, CVE-2024-53184,\nCVE-2024-53142, CVE-2024-56725, CVE-2024-49906, CVE-2024-56751,\nCVE-2024-56584, CVE-2024-56663, CVE-2024-53042, CVE-2024-50188,\nCVE-2024-53169, CVE-2024-53085, CVE-2024-56690, CVE-2024-50186,\nCVE-2024-53156, CVE-2024-50250, CVE-2024-56787, CVE-2024-50076,\nCVE-2024-53122, CVE-2024-56643, CVE-2024-50084, CVE-2024-50271,\nCVE-2024-53045, CVE-2024-53058, CVE-2024-50238, CVE-2024-50300,\nCVE-2024-56621, CVE-2024-56729, CVE-2024-50284, CVE-2024-53135,\nCVE-2024-50287, CVE-2024-53161, CVE-2024-56727, CVE-2024-50044,\nCVE-2024-56601, CVE-2024-53194, CVE-2024-50209, CVE-2024-50145,\nCVE-2024-53067, CVE-2024-53215, CVE-2024-56608, CVE-2024-56557,\nCVE-2025-21756, CVE-2024-53229, CVE-2024-53112, CVE-2024-50133,\nCVE-2024-50169, CVE-2025-21700, CVE-2024-50191, CVE-2024-57838,\nCVE-2024-56693, CVE-2024-53183, CVE-2024-50278, CVE-2024-53111,\nCVE-2024-50151, CVE-2024-53053, CVE-2024-56630, CVE-2024-50060,\nCVE-2024-56580, CVE-2024-50230, CVE-2024-53099, CVE-2024-56533,\nCVE-2024-56640, CVE-2024-50282, CVE-2024-50159, CVE-2024-56658,\nCVE-2024-50021, CVE-2024-50275, CVE-2024-50192, CVE-2024-50302,\nCVE-2024-50139, CVE-2024-53096, CVE-2024-50290, CVE-2024-50246,\nCVE-2024-50127, CVE-2024-56569, CVE-2024-50029, CVE-2024-53168,\nCVE-2025-21831, CVE-2024-53052, CVE-2024-56704, CVE-2024-57849,\nCVE-2024-50022, CVE-2024-50208, CVE-2024-53177, CVE-2024-56771,\nCVE-2024-50134, CVE-2024-53151, CVE-2024-50098, CVE-2024-53214,\nCVE-2024-56754, CVE-2024-43098, CVE-2024-50299, CVE-2024-50255,\nCVE-2024-56687, CVE-2024-53196, CVE-2024-53217, CVE-2024-48873,\nCVE-2024-53062, CVE-2024-53101, CVE-2024-56592, CVE-2024-53086,\nCVE-2024-50207, CVE-2024-50035, CVE-2024-50067, CVE-2024-50072,\nCVE-2024-56619, CVE-2024-53088, CVE-2024-53210, CVE-2024-56721,\nCVE-2024-56531, CVE-2024-56705, CVE-2024-50085, CVE-2024-53222,\nCVE-2024-50262, CVE-2024-50156, CVE-2024-45828, CVE-2024-53181,\nCVE-2024-50083, CVE-2024-53068, CVE-2024-53081, CVE-2024-50107,\nCVE-2022-49034, CVE-2024-50276, CVE-2024-50249, CVE-2024-50030,\nCVE-2024-53203, CVE-2024-50185, CVE-2024-50163, CVE-2024-50184,\nCVE-2024-53162, CVE-2024-56703, CVE-2024-56685, CVE-2024-56548,\nCVE-2024-53100, CVE-2024-56597, CVE-2024-53110, CVE-2024-50086,\nCVE-2024-56636, CVE-2024-56677, CVE-2024-50166, CVE-2024-50247,\nCVE-2024-53061, CVE-2024-56577, CVE-2024-50062, CVE-2024-56786,\nCVE-2024-50019, CVE-2024-56609, CVE-2024-48881, CVE-2024-53239,\nCVE-2024-53128, CVE-2024-56692, CVE-2024-50068, CVE-2024-56683,\nCVE-2024-56594, CVE-2024-53209, CVE-2024-50142, CVE-2024-56590,\nCVE-2024-56613, CVE-2024-53163, CVE-2024-50261, CVE-2024-53224,\nCVE-2024-56595, CVE-2024-50150, CVE-2024-53079, CVE-2024-56775,\nCVE-2024-53095, CVE-2024-50105, CVE-2024-50193, CVE-2024-53043,\nCVE-2024-53213, CVE-2024-56638, CVE-2024-50023, CVE-2024-50057,\nCVE-2024-50038, CVE-2024-56550, CVE-2024-53232, CVE-2024-50155,\nCVE-2024-53155, CVE-2024-53197, CVE-2024-50046, CVE-2024-50236,\nCVE-2024-50243, CVE-2024-53172, CVE-2024-53226, CVE-2024-53146,\nCVE-2024-42122, CVE-2024-50199, CVE-2024-50205, CVE-2024-50170,\nCVE-2024-50200, CVE-2024-56620, CVE-2024-50104, CVE-2024-56593,\nCVE-2024-53223, CVE-2024-53082, CVE-2024-50058, CVE-2024-56688,\nCVE-2024-56607, CVE-2024-53195, CVE-2024-41932, CVE-2024-56756,\nCVE-2024-53236, CVE-2024-56622, CVE-2024-50093, CVE-2024-53114,\nCVE-2024-56600, CVE-2024-53190, CVE-2024-53130, CVE-2024-53084,\nCVE-2024-56610, CVE-2024-53170, CVE-2024-53127, CVE-2024-49968,\nCVE-2024-50203, CVE-2024-50259, CVE-2024-50031, CVE-2024-53051,\nCVE-2024-50226, CVE-2024-56779, CVE-2024-56588, CVE-2024-56777,\nCVE-2024-50121, CVE-2024-50055, CVE-2024-50033, CVE-2024-50010,\nCVE-2024-53218, CVE-2024-56744, CVE-2024-50297, CVE-2024-50257,\nCVE-2024-56558, CVE-2024-50073, CVE-2024-56623, CVE-2024-50135,\nCVE-2024-50197, CVE-2024-56625, CVE-2024-56546, CVE-2024-53175,\nCVE-2024-50273, CVE-2024-50082, CVE-2024-56615, CVE-2024-53185,\nCVE-2024-50172, CVE-2024-50265, CVE-2024-56678, CVE-2024-48876,\nCVE-2024-50110, CVE-2024-50101, CVE-2024-50041, CVE-2024-53046,\nCVE-2024-50198, CVE-2024-50303, CVE-2024-56708, CVE-2024-56728,\nCVE-2024-50136, CVE-2024-56700, CVE-2024-50074, CVE-2024-50117,\nCVE-2024-50296)\n","status":"published","published":"2025-04-23T15:11:40Z","modified":"2026-11-03T21:17:42.731974836Z","updated_at":"2026-11-03T21:43:54.166508Z"},{"id":"USN-7452-1","title":"linux-gcp-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - RAM backed block device driver;\n  - Compressed RAM block device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - i.MX SoC drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - EROFS file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - UBI file system;\n  - DRM display driver;\n  - BPF subsystem;\n  - StackDepot library;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - DMA mapping infrastructure;\n  - Kernel fork() syscall;\n  - KCSAN framework;\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Task handling mechanism;\n  - Timer subsystem;\n  - KUnit library;\n  - Memory management;\n  - 9P file system network protocol;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Packet sockets;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n(CVE-2024-56724, CVE-2024-50108, CVE-2024-56631, CVE-2024-50236,\nCVE-2022-49034, CVE-2024-50133, CVE-2024-53108, CVE-2024-56605,\nCVE-2024-56599, CVE-2024-56721, CVE-2024-53110, CVE-2024-56751,\nCVE-2024-53120, CVE-2024-53198, CVE-2024-57876, CVE-2024-50285,\nCVE-2024-53133, CVE-2024-56681, CVE-2024-56581, CVE-2025-21701,\nCVE-2024-53086, CVE-2024-53201, CVE-2024-56630, CVE-2024-53222,\nCVE-2024-50139, CVE-2024-53084, CVE-2024-53214, CVE-2024-53183,\nCVE-2024-56600, CVE-2024-50286, CVE-2024-53232, CVE-2024-56777,\nCVE-2024-56540, CVE-2024-50121, CVE-2024-50284, CVE-2024-56621,\nCVE-2024-53195, CVE-2024-50279, CVE-2024-53203, CVE-2024-50104,\nCVE-2024-50238, CVE-2024-53177, CVE-2024-53053, CVE-2024-50297,\nCVE-2024-56569, CVE-2024-53131, CVE-2024-56642, CVE-2024-56752,\nCVE-2024-53079, CVE-2024-56705, CVE-2024-56679, CVE-2024-50272,\nCVE-2024-53231, CVE-2024-53228, CVE-2024-50128, CVE-2024-53229,\nCVE-2024-53055, CVE-2024-53050, CVE-2024-50265, CVE-2024-56703,\nCVE-2024-53114, CVE-2024-50278, CVE-2024-56771, CVE-2024-56708,\nCVE-2024-53082, CVE-2024-50051, CVE-2024-50125, CVE-2024-53109,\nCVE-2024-50257, CVE-2024-50107, CVE-2024-50290, CVE-2024-50211,\nCVE-2024-56609, CVE-2024-53190, CVE-2024-50232, CVE-2024-53134,\nCVE-2024-50142, CVE-2024-50166, CVE-2024-53051, CVE-2024-53224,\nCVE-2024-57872, CVE-2024-53200, CVE-2024-56685, CVE-2025-21700,\nCVE-2024-43098, CVE-2024-56604, CVE-2024-50218, CVE-2024-53113,\nCVE-2024-50242, CVE-2024-50223, CVE-2024-53099, CVE-2024-50162,\nCVE-2024-56587, CVE-2025-21756, CVE-2024-50126, CVE-2024-50067,\nCVE-2024-56539, CVE-2024-50153, CVE-2024-50251, CVE-2024-56726,\nCVE-2024-56780, CVE-2024-56700, CVE-2024-53059, CVE-2024-50252,\nCVE-2024-50269, CVE-2024-50163, CVE-2024-50248, CVE-2024-56578,\nCVE-2024-50240, CVE-2024-53155, CVE-2024-56613, CVE-2024-50118,\nCVE-2024-53091, CVE-2024-57838, CVE-2024-53094, CVE-2024-56638,\nCVE-2024-53175, CVE-2024-53062, CVE-2024-57843, CVE-2024-50210,\nCVE-2024-53237, CVE-2024-50115, CVE-2024-50164, CVE-2024-50208,\nCVE-2024-53068, CVE-2024-41932, CVE-2024-45828, CVE-2024-56635,\nCVE-2024-50112, CVE-2024-50289, CVE-2024-53197, CVE-2024-49906,\nCVE-2024-50304, CVE-2024-56625, CVE-2024-56785, CVE-2024-49899,\nCVE-2024-48876, CVE-2024-53236, CVE-2024-50216, CVE-2024-56756,\nCVE-2024-53178, CVE-2024-53095, CVE-2024-56786, CVE-2024-50111,\nCVE-2024-56643, CVE-2024-56584, CVE-2024-50298, CVE-2024-53089,\nCVE-2024-56550, CVE-2024-50221, CVE-2024-50160, CVE-2024-53188,\nCVE-2024-53066, CVE-2024-53047, CVE-2024-56765, CVE-2024-56601,\nCVE-2024-53146, CVE-2024-56597, CVE-2024-56622, CVE-2024-50205,\nCVE-2024-56647, CVE-2024-56651, CVE-2024-56572, CVE-2024-56568,\nCVE-2024-53087, CVE-2024-50152, CVE-2024-53230, CVE-2024-50276,\nCVE-2024-56562, CVE-2024-56565, CVE-2024-56596, CVE-2024-50237,\nCVE-2024-53194, CVE-2024-53176, CVE-2024-56754, CVE-2024-56593,\nCVE-2024-50225, CVE-2024-47143, CVE-2024-50301, CVE-2025-21831,\nCVE-2024-53151, CVE-2024-50259, CVE-2024-50150, CVE-2024-53145,\nCVE-2024-56590, CVE-2024-50222, CVE-2024-53058, CVE-2024-56687,\nCVE-2024-56690, CVE-2024-56538, CVE-2024-53044, CVE-2024-50292,\nCVE-2024-56577, CVE-2024-50235, CVE-2024-50172, CVE-2024-53127,\nCVE-2024-56615, CVE-2024-53088, CVE-2024-50141, CVE-2024-53223,\nCVE-2024-50135, CVE-2024-50262, CVE-2024-53174, CVE-2024-56545,\nCVE-2024-53093, CVE-2024-56586, CVE-2024-53118, CVE-2024-56727,\nCVE-2024-57874, CVE-2024-50267, CVE-2024-53048, CVE-2024-50250,\nCVE-2024-56533, CVE-2024-53196, CVE-2024-57849, CVE-2024-50010,\nCVE-2024-53129, CVE-2024-53119, CVE-2024-56742, CVE-2024-53045,\nCVE-2024-50226, CVE-2024-53173, CVE-2024-53220, CVE-2024-53185,\nCVE-2024-50294, CVE-2024-53181, CVE-2024-53150, CVE-2024-47809,\nCVE-2024-56746, CVE-2024-53233, CVE-2024-56620, CVE-2024-53213,\nCVE-2024-53163, CVE-2024-56648, CVE-2024-56640, CVE-2024-48873,\nCVE-2024-53209, CVE-2024-50246, CVE-2024-50258, CVE-2024-57850,\nCVE-2024-56549, CVE-2024-56627, CVE-2024-56778, CVE-2024-56720,\nCVE-2024-50256, CVE-2024-56725, CVE-2024-56729, CVE-2024-53046,\nCVE-2024-56573, CVE-2024-53112, CVE-2024-53115, CVE-2024-50234,\nCVE-2024-53172, CVE-2024-56558, CVE-2024-56787, CVE-2024-53184,\nCVE-2024-50131, CVE-2024-50255, CVE-2024-50155, CVE-2024-53187,\nCVE-2024-49569, CVE-2024-56616, CVE-2024-53147, CVE-2024-53123,\nCVE-2024-53162, CVE-2024-53126, CVE-2024-53061, CVE-2024-53210,\nCVE-2024-50138, CVE-2024-53105, CVE-2024-56644, CVE-2024-50105,\nCVE-2024-50207, CVE-2024-53158, CVE-2024-50261, CVE-2024-56693,\nCVE-2024-41935, CVE-2024-53128, CVE-2024-50116, CVE-2024-50143,\nCVE-2025-21702, CVE-2024-53072, CVE-2024-53100, CVE-2024-42122,\nCVE-2024-50303, CVE-2024-50124, CVE-2024-56606, CVE-2024-56557,\nCVE-2024-53083, CVE-2024-50299, CVE-2024-56589, CVE-2024-50296,\nCVE-2024-50275, CVE-2024-56698, CVE-2024-50245, CVE-2024-50263,\nCVE-2024-56633, CVE-2024-50230, CVE-2024-56579, CVE-2024-50231,\nCVE-2024-50295, CVE-2024-56611, CVE-2024-56689, CVE-2024-50159,\nCVE-2024-53680, CVE-2024-56551, CVE-2024-56748, CVE-2024-50249,\nCVE-2024-53168, CVE-2024-56632, CVE-2024-53060, CVE-2024-41014,\nCVE-2024-53121, CVE-2024-50145, CVE-2024-53081, CVE-2024-50151,\nCVE-2024-56781, CVE-2024-50110, CVE-2024-53148, CVE-2024-56567,\nCVE-2024-56641, CVE-2024-53208, CVE-2024-56619, CVE-2024-52332,\nCVE-2024-56775, CVE-2024-56626, CVE-2024-56688, CVE-2024-53215,\nCVE-2024-56783, CVE-2024-50103, CVE-2024-53226, CVE-2024-50282,\nCVE-2024-56755, CVE-2024-50268, CVE-2024-50271, CVE-2024-53076,\nCVE-2024-56610, CVE-2024-56636, CVE-2024-44955, CVE-2024-56623,\nCVE-2024-56694, CVE-2024-56608, CVE-2024-56576, CVE-2024-56692,\nCVE-2024-56723, CVE-2024-53191, CVE-2024-56677, CVE-2024-48875,\nCVE-2024-53106, CVE-2024-56678, CVE-2024-50273, CVE-2024-50206,\nCVE-2024-50170, CVE-2024-56594, CVE-2024-56707, CVE-2024-56649,\nCVE-2024-50167, CVE-2024-56691, CVE-2024-56683, CVE-2024-53052,\nCVE-2024-56747, CVE-2024-47141, CVE-2024-56543, CVE-2024-56574,\nCVE-2024-53085, CVE-2024-50136, CVE-2024-56779, CVE-2024-53111,\nCVE-2024-53139, CVE-2024-56704, CVE-2024-56745, CVE-2024-53234,\nCVE-2024-53138, CVE-2024-50130, CVE-2024-48881, CVE-2024-53107,\nCVE-2024-53218, CVE-2024-56602, CVE-2024-56531, CVE-2024-53154,\nCVE-2024-56532, CVE-2024-53130, CVE-2024-50215, CVE-2024-50147,\nCVE-2024-56607, CVE-2024-50137, CVE-2024-47794, CVE-2024-50158,\nCVE-2024-50239, CVE-2024-56645, CVE-2024-53171, CVE-2024-56592,\nCVE-2024-56772, CVE-2024-50288, CVE-2024-50156, CVE-2024-53180,\nCVE-2024-53169, CVE-2024-56634, CVE-2024-56728, CVE-2024-56722,\nCVE-2024-50209, CVE-2024-56588, CVE-2024-53096, CVE-2024-56548,\nCVE-2024-53166, CVE-2024-56773, CVE-2024-56575, CVE-2024-56650,\nCVE-2024-50127, CVE-2024-56744, CVE-2024-56546, CVE-2024-50154,\nCVE-2024-53202, CVE-2024-56782, CVE-2024-50270, CVE-2024-53157,\nCVE-2024-50243, CVE-2024-56583, CVE-2024-53239, CVE-2025-21993,\nCVE-2024-56603, CVE-2024-56629, CVE-2024-53135, CVE-2024-56739,\nCVE-2024-50283, CVE-2024-56580, CVE-2024-50169, CVE-2024-56774,\nCVE-2024-53042, CVE-2024-53227, CVE-2024-53067, CVE-2024-50224,\nCVE-2024-50247, CVE-2024-53122, CVE-2024-53090, CVE-2024-53221,\nCVE-2024-50146, CVE-2024-53219, CVE-2024-53142, CVE-2024-56570,\nCVE-2024-56566, CVE-2024-50140, CVE-2024-56776, CVE-2024-50287,\nCVE-2024-53161, CVE-2024-50300, CVE-2024-53160, CVE-2024-50203,\nCVE-2024-53217, CVE-2024-50244, CVE-2024-53043, CVE-2024-50280,\nCVE-2024-56637, CVE-2024-53117, CVE-2024-56701, CVE-2024-50291,\nCVE-2024-50120, CVE-2024-53101, CVE-2024-50220, CVE-2024-56561)\n","status":"published","published":"2025-04-23T15:29:33Z","modified":"2026-11-03T21:17:31.85697949Z","updated_at":"2026-11-03T21:43:54.166508Z"},{"id":"USN-7453-1","title":"linux-realtime vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - SuperH RISC architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - RAM backed block device driver;\n  - Compressed RAM block device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - StarFive reset controller drivers;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - i.MX SoC drivers;\n  - QCOM SoC drivers;\n  - Xilinx SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - File systems infrastructure;\n  - EROFS file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - UBI file system;\n  - DRM display driver;\n  - BPF subsystem;\n  - StackDepot library;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - DMA mapping infrastructure;\n  - Kernel fork() syscall;\n  - KCSAN framework;\n  - RCU subsystem;\n  - Arbitrary resource management;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Task handling mechanism;\n  - Timer subsystem;\n  - KUnit library;\n  - Memory management;\n  - 9P file system network protocol;\n  - CAN network layer;\n  - Networking core;\n  - DCCP (Datagram Congestion Control Protocol);\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Packet sockets;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - ALSA framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n(CVE-2024-53187, CVE-2024-50268, CVE-2024-53161, CVE-2024-56721,\nCVE-2024-53059, CVE-2024-53217, CVE-2022-49034, CVE-2024-53061,\nCVE-2024-50284, CVE-2024-50167, CVE-2024-53221, CVE-2024-56773,\nCVE-2024-53051, CVE-2024-50263, CVE-2024-56631, CVE-2024-53106,\nCVE-2024-50051, CVE-2024-50164, CVE-2024-56533, CVE-2024-53218,\nCVE-2024-56678, CVE-2024-56692, CVE-2024-50155, CVE-2025-21702,\nCVE-2024-53100, CVE-2024-50208, CVE-2024-56707, CVE-2024-56781,\nCVE-2024-48873, CVE-2024-50159, CVE-2024-50138, CVE-2024-50291,\nCVE-2024-53091, CVE-2024-56708, CVE-2024-50142, CVE-2024-50105,\nCVE-2024-50299, CVE-2024-50203, CVE-2024-53210, CVE-2024-56625,\nCVE-2024-53147, CVE-2024-50226, CVE-2024-50294, CVE-2024-50128,\nCVE-2024-53060, CVE-2024-56776, CVE-2024-56586, CVE-2024-56569,\nCVE-2024-53214, CVE-2024-53172, CVE-2024-48881, CVE-2024-53119,\nCVE-2024-50121, CVE-2024-53195, CVE-2024-56703, CVE-2024-56572,\nCVE-2024-50225, CVE-2024-50133, CVE-2024-50280, CVE-2024-53190,\nCVE-2024-56685, CVE-2024-53067, CVE-2024-56538, CVE-2024-53200,\nCVE-2024-56694, CVE-2024-53173, CVE-2024-53118, CVE-2024-53047,\nCVE-2024-50103, CVE-2024-56638, CVE-2024-50257, CVE-2024-53171,\nCVE-2024-57874, CVE-2024-56626, CVE-2024-56611, CVE-2024-56642,\nCVE-2024-56636, CVE-2025-21756, CVE-2024-53188, CVE-2024-56633,\nCVE-2024-53181, CVE-2024-50218, CVE-2024-56771, CVE-2024-56778,\nCVE-2024-56568, CVE-2024-56720, CVE-2024-50249, CVE-2024-53175,\nCVE-2024-53160, CVE-2024-53093, CVE-2024-56754, CVE-2024-53084,\nCVE-2024-53215, CVE-2024-47794, CVE-2024-50287, CVE-2024-49899,\nCVE-2024-56651, CVE-2024-53191, CVE-2024-56744, CVE-2024-50158,\nCVE-2024-56619, CVE-2024-53162, CVE-2024-53208, CVE-2024-56729,\nCVE-2024-56545, CVE-2024-56605, CVE-2024-48876, CVE-2024-50290,\nCVE-2024-53154, CVE-2024-56620, CVE-2025-21700, CVE-2024-53148,\nCVE-2024-50156, CVE-2024-53138, CVE-2024-50269, CVE-2024-50141,\nCVE-2024-56551, CVE-2024-50221, CVE-2024-50288, CVE-2024-56546,\nCVE-2024-50209, CVE-2024-53234, CVE-2024-50232, CVE-2024-53086,\nCVE-2024-53232, CVE-2024-50112, CVE-2024-57838, CVE-2024-53220,\nCVE-2024-53121, CVE-2024-53142, CVE-2024-56610, CVE-2024-57872,\nCVE-2024-50160, CVE-2024-50010, CVE-2024-56690, CVE-2024-53128,\nCVE-2024-56650, CVE-2024-53158, CVE-2024-57850, CVE-2024-53088,\nCVE-2024-56629, CVE-2024-50239, CVE-2024-50145, CVE-2024-56724,\nCVE-2024-56566, CVE-2024-50303, CVE-2024-53053, CVE-2024-56539,\nCVE-2024-50153, CVE-2024-50242, CVE-2024-53055, CVE-2024-53127,\nCVE-2024-56751, CVE-2024-56588, CVE-2024-56691, CVE-2024-53180,\nCVE-2024-53076, CVE-2024-53072, CVE-2024-53196, CVE-2024-56679,\nCVE-2024-53042, CVE-2024-56777, CVE-2024-42122, CVE-2024-50244,\nCVE-2024-50169, CVE-2024-50205, CVE-2024-53110, CVE-2024-53157,\nCVE-2024-50295, CVE-2024-53680, CVE-2024-56613, CVE-2024-53194,\nCVE-2024-56779, CVE-2024-56597, CVE-2024-50130, CVE-2024-53083,\nCVE-2024-50246, CVE-2024-53131, CVE-2024-53107, CVE-2024-56756,\nCVE-2024-56727, CVE-2024-50162, CVE-2024-50273, CVE-2024-56726,\nCVE-2024-50255, CVE-2024-53185, CVE-2024-50137, CVE-2024-41932,\nCVE-2024-56787, CVE-2024-56765, CVE-2024-56601, CVE-2024-56698,\nCVE-2024-56558, CVE-2024-57876, CVE-2024-56581, CVE-2024-53202,\nCVE-2024-50236, CVE-2024-56681, CVE-2024-50297, CVE-2024-53203,\nCVE-2024-53081, CVE-2024-53155, CVE-2024-50275, CVE-2024-56630,\nCVE-2024-50166, CVE-2024-57843, CVE-2024-56677, CVE-2024-53094,\nCVE-2024-53048, CVE-2024-50125, CVE-2024-50216, CVE-2024-56774,\nCVE-2024-44955, CVE-2024-56748, CVE-2024-50223, CVE-2024-53087,\nCVE-2024-56775, CVE-2024-50298, CVE-2024-56627, CVE-2024-50139,\nCVE-2024-53134, CVE-2024-53224, CVE-2024-53150, CVE-2024-56704,\nCVE-2024-53198, CVE-2024-53111, CVE-2024-50251, CVE-2024-53082,\nCVE-2024-56785, CVE-2024-56647, CVE-2024-50282, CVE-2024-53058,\nCVE-2024-56637, CVE-2024-50283, CVE-2024-50135, CVE-2024-56622,\nCVE-2024-50301, CVE-2024-50147, CVE-2024-50252, CVE-2024-56567,\nCVE-2024-50230, CVE-2024-53105, CVE-2024-56574, CVE-2024-56589,\nCVE-2024-56543, CVE-2024-50267, CVE-2024-53163, CVE-2024-53123,\nCVE-2024-50248, CVE-2024-53219, CVE-2024-50238, CVE-2024-50296,\nCVE-2024-56593, CVE-2024-56645, CVE-2024-50270, CVE-2024-56780,\nCVE-2024-56576, CVE-2024-53114, CVE-2024-53089, CVE-2024-56644,\nCVE-2024-56739, CVE-2024-53184, CVE-2024-56700, CVE-2024-56786,\nCVE-2024-43098, CVE-2024-50115, CVE-2024-53201, CVE-2024-50220,\nCVE-2024-53226, CVE-2024-53222, CVE-2024-53133, CVE-2024-50222,\nCVE-2024-56640, CVE-2024-50206, CVE-2024-53229, CVE-2024-41014,\nCVE-2024-50272, CVE-2024-56641, CVE-2024-53237, CVE-2024-50207,\nCVE-2024-53168, CVE-2024-56592, CVE-2024-53090, CVE-2024-56782,\nCVE-2024-53043, CVE-2024-50289, CVE-2024-56687, CVE-2024-56755,\nCVE-2024-50111, CVE-2024-57849, CVE-2024-53231, CVE-2024-56550,\nCVE-2024-50247, CVE-2024-53085, CVE-2024-56745, CVE-2024-56600,\nCVE-2024-56596, CVE-2024-50150, CVE-2024-56623, CVE-2024-53108,\nCVE-2024-56579, CVE-2024-50151, CVE-2024-56548, CVE-2024-56565,\nCVE-2024-50110, CVE-2024-47141, CVE-2024-41935, CVE-2024-50274,\nCVE-2024-56603, CVE-2024-53197, CVE-2024-56688, CVE-2024-56577,\nCVE-2024-53174, CVE-2024-56723, CVE-2024-56616, CVE-2024-56573,\nCVE-2024-53044, CVE-2024-53109, CVE-2024-52332, CVE-2024-53079,\nCVE-2024-50131, CVE-2024-53068, CVE-2024-50163, CVE-2024-56772,\nCVE-2024-56634, CVE-2024-53095, CVE-2024-50215, CVE-2024-50243,\nCVE-2024-50265, CVE-2024-56540, CVE-2024-53045, CVE-2024-56562,\nCVE-2024-53135, CVE-2024-56689, CVE-2024-56570, CVE-2024-53066,\nCVE-2024-53145, CVE-2024-56580, CVE-2024-53101, CVE-2024-53177,\nCVE-2024-53183, CVE-2024-53115, CVE-2024-56722, CVE-2025-21993,\nCVE-2024-49569, CVE-2025-21831, CVE-2024-50279, CVE-2024-53052,\nCVE-2024-53113, CVE-2024-50292, CVE-2024-50224, CVE-2024-50259,\nCVE-2024-56615, CVE-2024-56649, CVE-2024-53169, CVE-2024-56635,\nCVE-2024-50261, CVE-2024-50172, CVE-2024-53228, CVE-2024-53166,\nCVE-2024-50140, CVE-2024-50170, CVE-2024-56587, CVE-2024-56607,\nCVE-2024-56575, CVE-2024-53099, CVE-2024-49906, CVE-2024-50234,\nCVE-2024-56531, CVE-2024-50127, CVE-2024-56608, CVE-2024-56583,\nCVE-2024-56648, CVE-2024-48875, CVE-2024-50152, CVE-2024-53062,\nCVE-2024-53176, CVE-2024-50250, CVE-2024-53233, CVE-2024-56578,\nCVE-2024-53112, CVE-2024-53146, CVE-2024-56590, CVE-2024-56584,\nCVE-2024-50211, CVE-2024-50116, CVE-2024-50124, CVE-2024-50067,\nCVE-2024-53050, CVE-2024-45828, CVE-2024-47809, CVE-2024-50276,\nCVE-2024-56557, CVE-2024-50304, CVE-2024-56742, CVE-2024-50108,\nCVE-2024-53122, CVE-2024-56602, CVE-2024-50235, CVE-2024-50278,\nCVE-2024-56561, CVE-2024-56632, CVE-2025-21701, CVE-2024-56752,\nCVE-2024-50262, CVE-2024-56621, CVE-2024-53129, CVE-2024-50285,\nCVE-2024-56643, CVE-2024-53227, CVE-2024-50258, CVE-2024-53139,\nCVE-2024-53209, CVE-2024-56701, CVE-2024-56594, CVE-2024-53223,\nCVE-2024-50136, CVE-2024-50256, CVE-2024-53178, CVE-2024-53236,\nCVE-2024-56549, CVE-2024-56683, CVE-2024-53126, CVE-2024-53120,\nCVE-2024-53117, CVE-2024-50104, CVE-2024-50146, CVE-2024-53239,\nCVE-2024-56599, CVE-2024-50210, CVE-2024-56609, CVE-2024-50245,\nCVE-2024-56705, CVE-2024-56604, CVE-2024-50118, CVE-2024-56783,\nCVE-2024-50271, CVE-2024-53151, CVE-2024-56728, CVE-2024-56746,\nCVE-2024-53213, CVE-2024-50231, CVE-2024-56532, CVE-2024-53130,\nCVE-2024-50143, CVE-2024-50286, CVE-2024-53230, CVE-2024-53096,\nCVE-2024-50154, CVE-2024-50237, CVE-2024-50240, CVE-2024-56725,\nCVE-2024-56693, CVE-2024-56606, CVE-2024-50126, CVE-2024-56747,\nCVE-2024-50107, CVE-2024-50300, CVE-2024-47143, CVE-2024-53046,\nCVE-2024-50120)\n","status":"published","published":"2025-04-23T16:18:00Z","modified":"2026-11-03T21:17:47.102596108Z","updated_at":"2026-11-03T21:43:54.166508Z"}]}}