{"id":"CVE-2025-21710","aliases":["BELL-CVE-2025-21710","DEBIAN-CVE-2025-21710","EUVD-2025-5241","GHSA-q383-xwj3-rcf5","OESA-2025-1339","OESA-2025-1340","ROOT-OS-UBUNTU-2404-CVE-2025-21710","SUSE-SU-2025:4393-1","SUSE-SU-2025:4422-1","SUSE-SU-2025:4505-1","SUSE-SU-2025:4516-1","SUSE-SU-2025:4517-1","SUSE-SU-2025:4521-1","SUSE-SU-2026:20039-1","SUSE-SU-2026:20059-1","SUSE-SU-2026:20473-1","SUSE-SU-2026:20496-1","SUSE-SU-2026:3593-1","SUSE-SU-2026:3595-1","SUSE-SU-2026:3616-1","SUSE-SU-2026:3617-1","UBUNTU-CVE-2025-21710","USN-7521-1","USN-7521-3","USN-7651-1","USN-7651-2","USN-7651-3","USN-7651-4","USN-7651-5","USN-7651-6","USN-7652-1","USN-7653-1","USN-7737-1"],"status":"published","title":"tcp: correct handling of extreme memory squeeze","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \"pasta\" protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn't influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side's notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u003e)\n//                tcp_rcv_established(-\u003e)\n[5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e)\n[5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-)\n[5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:       tcp_select_window(-\u003e)\n[5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n                        returning 0\n[5201\u003c-\u003e39222]:       tcp_select_window(\u003c-)\n[5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-)\n[5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-)\n[5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0]\n[5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()\n                    [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u003ercv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00274,"percentile":0.20006,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-667"],"published":"2025-02-27T02:07:23Z","modified":"2026-11-06T16:17:43Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.6.76","6.12.13","6.13.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.12.13-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1032.34~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1034.39~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1033.35~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-64.67~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1029.29~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-64.67.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1031.34~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1029.30~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-64.67~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1025.26~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-64.67"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1032.34"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1034.39"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","fixed_in":["6.11.0-1015.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","fixed_in":["6.8.0-1022.23"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1033.35"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","fixed_in":["6.11.0-1015.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1028.32"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1015.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","fixed_in":["6.11.0-26.26~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1029.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-64.67.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","fixed_in":["6.11.0-1014.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1031.34"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","fixed_in":["6.11.0-1010.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1031.34.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","fixed_in":["6.11.0-1022.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","fixed_in":["6.8.0-1031.31"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1029.30"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1031.35"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","fixed_in":["6.8.0-1017.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2026.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1025.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","fixed_in":["6.8.0-78.78+fips1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.89-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.76"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.13.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-84.0.0.78.oe2403"}]}],"bundled":59},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-84.0.0.89.oe2403sp1"}]}],"bundled":47},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1.150700.17.17.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.2"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3.150600.12.36.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.2"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.2"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3.150600.12.36.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.2"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.81.3"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.58.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.58.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.58.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.58.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.58.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.58.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.25.1"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.21.1"}]}],"bundled":70},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.21.1"}]}],"bundled":70},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.21.1"}]}],"bundled":70},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6-RT_Update_18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.1.3.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.61.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1.21.15"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1.21.15"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":65},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1.150400.24.118.3"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1.150400.24.118.3"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-livepatch-SLE15-SP4_Update_58","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150400.9.7.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1.150400.24.118.3"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1.150400.24.118.3"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1.150400.24.118.3"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1.150400.24.118.3"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.235.1"}]}],"bundled":59},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1.150500.6.85.2"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5_Update_44","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.5.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1.150500.6.85.2"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1.150500.6.85.2"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1.150500.6.85.2"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1.150500.6.85.2"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.182.1"}]}],"bundled":74},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.181.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.181.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.181.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.181.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.156.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.156.1"}]}],"bundled":75},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1032.34~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1034.39~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1033.35~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.29~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.34~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1025.26~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1032.34"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1034.39"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1015.15~24.04.1"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1022.23"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1033.35"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1015.15~24.04.1"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.32"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.17"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-26.26~24.04.1"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.29"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1014.15~24.04.1"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.34"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1010.10"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.34.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1008.8"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1022.22"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.31"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.35"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.18"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2026.27"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1025.26"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-78.78+fips1"}]}],"versions":["6.8.0-38.38+fips4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1015.15~24.04.1"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1"],"bundled":228},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1015.15~24.04.1"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1"],"bundled":228},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-26.26~24.04.1"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1"],"bundled":228},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1022.22"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21"],"bundled":228},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-1014.15~24.04.1"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1"],"bundled":228},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1032.34"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.31"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.29~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.29"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1032.34~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.34~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.32"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.17"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.34"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.34.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1033.35~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1033.35"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2026.27"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1031.35"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1025.26"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25"],"bundled":117},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-64.67~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1"],"bundled":158},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1034.39~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1"],"bundled":188},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1034.39"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36"],"bundled":188},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1022.23"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20"],"bundled":188}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/b01e7ceb35dcb7ffad413da657b78c3340a09039","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/1dd823a46e25ffde1492c391934f69a9e5eb574f","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/b4055e2fe96f4ef101d8af0feb056d78d77514ff","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/8c670bdfa58e48abad1d5b6ca1ee843ca91f7303","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21710","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q383-xwj3-rcf5"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-21710","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21710.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-21710","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1339","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57997","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21853","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1340","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254393-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235463","tags":["report"]},{"url":"https://bugzilla.suse.com/1236743","tags":["report"]},{"url":"https://bugzilla.suse.com/1237888","tags":["report"]},{"url":"https://bugzilla.suse.com/1241166","tags":["report"]},{"url":"https://bugzilla.suse.com/1243474","tags":["report"]},{"url":"https://bugzilla.suse.com/1245193","tags":["report"]},{"url":"https://bugzilla.suse.com/1247076","tags":["report"]},{"url":"https://bugzilla.suse.com/1247500","tags":["report"]},{"url":"https://bugzilla.suse.com/1247509","tags":["report"]},{"url":"https://bugzilla.suse.com/1247683","tags":["report"]},{"url":"https://bugzilla.suse.com/1249547","tags":["report"]},{"url":"https://bugzilla.suse.com/1249912","tags":["report"]},{"url":"https://bugzilla.suse.com/1249982","tags":["report"]},{"url":"https://bugzilla.suse.com/1250034","tags":["report"]},{"url":"https://bugzilla.suse.com/1250176","tags":["report"]},{"url":"https://bugzilla.suse.com/1250237","tags":["report"]},{"url":"https://bugzilla.suse.com/1250252","tags":["report"]},{"url":"https://bugzilla.suse.com/1250705","tags":["report"]},{"url":"https://bugzilla.suse.com/1251120","tags":["report"]},{"url":"https://bugzilla.suse.com/1251786","tags":["report"]},{"url":"https://bugzilla.suse.com/1252063","tags":["report"]},{"url":"https://bugzilla.suse.com/1252267","tags":["report"]},{"url":"https://bugzilla.suse.com/1252269","tags":["report"]},{"url":"https://bugzilla.suse.com/1252303","tags":["report"]},{"url":"https://bugzilla.suse.com/1252352","tags":["report"]},{"url":"https://bugzilla.suse.com/1252353","tags":["report"]},{"url":"https://bugzilla.suse.com/1252365","tags":["report"]},{"url":"https://bugzilla.suse.com/1252366","tags":["report"]},{"url":"https://bugzilla.suse.com/1252368","tags":["report"]},{"url":"https://bugzilla.suse.com/1252370","tags":["report"]},{"url":"https://bugzilla.suse.com/1252681","tags":["report"]},{"url":"https://bugzilla.suse.com/1252763","tags":["report"]},{"url":"https://bugzilla.suse.com/1252773","tags":["report"]},{"url":"https://bugzilla.suse.com/1252774","tags":["report"]},{"url":"https://bugzilla.suse.com/1252780","tags":["report"]},{"url":"https://bugzilla.suse.com/1252790","tags":["report"]},{"url":"https://bugzilla.suse.com/1252794","tags":["report"]},{"url":"https://bugzilla.suse.com/1252795","tags":["report"]},{"url":"https://bugzilla.suse.com/1252809","tags":["report"]},{"url":"https://bugzilla.suse.com/1252817","tags":["report"]},{"url":"https://bugzilla.suse.com/1252821","tags":["report"]},{"url":"https://bugzilla.suse.com/1252836","tags":["report"]},{"url":"https://bugzilla.suse.com/1252845","tags":["report"]},{"url":"https://bugzilla.suse.com/1252862","tags":["report"]},{"url":"https://bugzilla.suse.com/1252912","tags":["report"]},{"url":"https://bugzilla.suse.com/1252917","tags":["report"]},{"url":"https://bugzilla.suse.com/1252923","tags":["report"]},{"url":"https://bugzilla.suse.com/1252928","tags":["report"]},{"url":"https://bugzilla.suse.com/1253018","tags":["report"]},{"url":"https://bugzilla.suse.com/1253176","tags":["report"]},{"url":"https://bugzilla.suse.com/1253275","tags":["report"]},{"url":"https://bugzilla.suse.com/1253318","tags":["report"]},{"url":"https://bugzilla.suse.com/1253324","tags":["report"]},{"url":"https://bugzilla.suse.com/1253349","tags":["report"]},{"url":"https://bugzilla.suse.com/1253352","tags":["report"]},{"url":"https://bugzilla.suse.com/1253355","tags":["report"]},{"url":"https://bugzilla.suse.com/1253360","tags":["report"]},{"url":"https://bugzilla.suse.com/1253362","tags":["report"]},{"url":"https://bugzilla.suse.com/1253363","tags":["report"]},{"url":"https://bugzilla.suse.com/1253367","tags":["report"]},{"url":"https://bugzilla.suse.com/1253369","tags":["report"]},{"url":"https://bugzilla.suse.com/1253393","tags":["report"]},{"url":"https://bugzilla.suse.com/1253394","tags":["report"]},{"url":"https://bugzilla.suse.com/1253395","tags":["report"]},{"url":"https://bugzilla.suse.com/1253403","tags":["report"]},{"url":"https://bugzilla.suse.com/1253407","tags":["report"]},{"url":"https://bugzilla.suse.com/1253409","tags":["report"]},{"url":"https://bugzilla.suse.com/1253412","tags":["report"]},{"url":"https://bugzilla.suse.com/1253416","tags":["report"]},{"url":"https://bugzilla.suse.com/1253421","tags":["report"]},{"url":"https://bugzilla.suse.com/1253423","tags":["report"]},{"url":"https://bugzilla.suse.com/1253424","tags":["report"]},{"url":"https://bugzilla.suse.com/1253425","tags":["report"]},{"url":"https://bugzilla.suse.com/1253427","tags":["report"]},{"url":"https://bugzilla.suse.com/1253428","tags":["report"]},{"url":"https://bugzilla.suse.com/1253431","tags":["report"]},{"url":"https://bugzilla.suse.com/1253436","tags":["report"]},{"url":"https://bugzilla.suse.com/1253438","tags":["report"]},{"url":"https://bugzilla.suse.com/1253440","tags":["report"]},{"url":"https://bugzilla.suse.com/1253441","tags":["report"]},{"url":"https://bugzilla.suse.com/1253445","tags":["report"]},{"url":"https://bugzilla.suse.com/1253448","tags":["report"]},{"url":"https://bugzilla.suse.com/1253449","tags":["report"]},{"url":"https://bugzilla.suse.com/1253453","tags":["report"]},{"url":"https://bugzilla.suse.com/1253456","tags":["report"]},{"url":"https://bugzilla.suse.com/1253472","tags":["report"]},{"url":"https://bugzilla.suse.com/1253648","tags":["report"]},{"url":"https://bugzilla.suse.com/1253779","tags":["report"]},{"url":"https://bugzilla.suse.com/1254181","tags":["report"]},{"url":"https://bugzilla.suse.com/1254221","tags":["report"]},{"url":"https://bugzilla.suse.com/1254235","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-50253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40207","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254422-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232223","tags":["report"]},{"url":"https://bugzilla.suse.com/1247079","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38361","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254505-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254516-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254517-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38360","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254521-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620039-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620059-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620473-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620496-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263593-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185845","tags":["report"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1254767","tags":["report"]},{"url":"https://bugzilla.suse.com/1255616","tags":["report"]},{"url":"https://bugzilla.suse.com/1258718","tags":["report"]},{"url":"https://bugzilla.suse.com/1262573","tags":["report"]},{"url":"https://bugzilla.suse.com/1263718","tags":["report"]},{"url":"https://bugzilla.suse.com/1263788","tags":["report"]},{"url":"https://bugzilla.suse.com/1264013","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264089","tags":["report"]},{"url":"https://bugzilla.suse.com/1265308","tags":["report"]},{"url":"https://bugzilla.suse.com/1266238","tags":["report"]},{"url":"https://bugzilla.suse.com/1266850","tags":["report"]},{"url":"https://bugzilla.suse.com/1267384","tags":["report"]},{"url":"https://bugzilla.suse.com/1267435","tags":["report"]},{"url":"https://bugzilla.suse.com/1267494","tags":["report"]},{"url":"https://bugzilla.suse.com/1267596","tags":["report"]},{"url":"https://bugzilla.suse.com/1267656","tags":["report"]},{"url":"https://bugzilla.suse.com/1267715","tags":["report"]},{"url":"https://bugzilla.suse.com/1268029","tags":["report"]},{"url":"https://bugzilla.suse.com/1269172","tags":["report"]},{"url":"https://bugzilla.suse.com/1269174","tags":["report"]},{"url":"https://bugzilla.suse.com/1269181","tags":["report"]},{"url":"https://bugzilla.suse.com/1269188","tags":["report"]},{"url":"https://bugzilla.suse.com/1269289","tags":["report"]},{"url":"https://bugzilla.suse.com/1269577","tags":["report"]},{"url":"https://bugzilla.suse.com/1269731","tags":["report"]},{"url":"https://bugzilla.suse.com/1269773","tags":["report"]},{"url":"https://bugzilla.suse.com/1269986","tags":["report"]},{"url":"https://bugzilla.suse.com/1269988","tags":["report"]},{"url":"https://bugzilla.suse.com/1269993","tags":["report"]},{"url":"https://bugzilla.suse.com/1269997","tags":["report"]},{"url":"https://bugzilla.suse.com/1270230","tags":["report"]},{"url":"https://bugzilla.suse.com/1270257","tags":["report"]},{"url":"https://bugzilla.suse.com/1271526","tags":["report"]},{"url":"https://bugzilla.suse.com/1271825","tags":["report"]},{"url":"https://bugzilla.suse.com/1271899","tags":["report"]},{"url":"https://bugzilla.suse.com/1271904","tags":["report"]},{"url":"https://bugzilla.suse.com/1271908","tags":["report"]},{"url":"https://bugzilla.suse.com/1271912","tags":["report"]},{"url":"https://bugzilla.suse.com/1271964","tags":["report"]},{"url":"https://bugzilla.suse.com/1272176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272180","tags":["report"]},{"url":"https://bugzilla.suse.com/1272207","tags":["report"]},{"url":"https://bugzilla.suse.com/1272242","tags":["report"]},{"url":"https://bugzilla.suse.com/1272263","tags":["report"]},{"url":"https://bugzilla.suse.com/1272268","tags":["report"]},{"url":"https://bugzilla.suse.com/1272607","tags":["report"]},{"url":"https://bugzilla.suse.com/1272678","tags":["report"]},{"url":"https://bugzilla.suse.com/1272694","tags":["report"]},{"url":"https://bugzilla.suse.com/1272855","tags":["report"]},{"url":"https://bugzilla.suse.com/1272865","tags":["report"]},{"url":"https://bugzilla.suse.com/1272904","tags":["report"]},{"url":"https://bugzilla.suse.com/1272907","tags":["report"]},{"url":"https://bugzilla.suse.com/1272918","tags":["report"]},{"url":"https://bugzilla.suse.com/1273004","tags":["report"]},{"url":"https://bugzilla.suse.com/1273035","tags":["report"]},{"url":"https://bugzilla.suse.com/1273097","tags":["report"]},{"url":"https://bugzilla.suse.com/1273231","tags":["report"]},{"url":"https://bugzilla.suse.com/1274072","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226591","tags":["report"]},{"url":"https://bugzilla.suse.com/1239015","tags":["report"]},{"url":"https://bugzilla.suse.com/1240552","tags":["report"]},{"url":"https://bugzilla.suse.com/1240727","tags":["report"]},{"url":"https://bugzilla.suse.com/1244229","tags":["report"]},{"url":"https://bugzilla.suse.com/1245457","tags":["report"]},{"url":"https://bugzilla.suse.com/1245728","tags":["report"]},{"url":"https://bugzilla.suse.com/1245729","tags":["report"]},{"url":"https://bugzilla.suse.com/1245730","tags":["report"]},{"url":"https://bugzilla.suse.com/1245731","tags":["report"]},{"url":"https://bugzilla.suse.com/1246203","tags":["report"]},{"url":"https://bugzilla.suse.com/1246212","tags":["report"]},{"url":"https://bugzilla.suse.com/1251135","tags":["report"]},{"url":"https://bugzilla.suse.com/1251971","tags":["report"]},{"url":"https://bugzilla.suse.com/1252266","tags":["report"]},{"url":"https://bugzilla.suse.com/1253049","tags":["report"]},{"url":"https://bugzilla.suse.com/1256690","tags":["report"]},{"url":"https://bugzilla.suse.com/1257466","tags":["report"]},{"url":"https://bugzilla.suse.com/1257472","tags":["report"]},{"url":"https://bugzilla.suse.com/1257541","tags":["report"]},{"url":"https://bugzilla.suse.com/1259580","tags":["report"]},{"url":"https://bugzilla.suse.com/1260347","tags":["report"]},{"url":"https://bugzilla.suse.com/1261648","tags":["report"]},{"url":"https://bugzilla.suse.com/1263010","tags":["report"]},{"url":"https://bugzilla.suse.com/1264053","tags":["report"]},{"url":"https://bugzilla.suse.com/1264387","tags":["report"]},{"url":"https://bugzilla.suse.com/1264558","tags":["report"]},{"url":"https://bugzilla.suse.com/1264779","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266414","tags":["report"]},{"url":"https://bugzilla.suse.com/1266758","tags":["report"]},{"url":"https://bugzilla.suse.com/1266765","tags":["report"]},{"url":"https://bugzilla.suse.com/1266913","tags":["report"]},{"url":"https://bugzilla.suse.com/1267375","tags":["report"]},{"url":"https://bugzilla.suse.com/1267584","tags":["report"]},{"url":"https://bugzilla.suse.com/1268237","tags":["report"]},{"url":"https://bugzilla.suse.com/1268750","tags":["report"]},{"url":"https://bugzilla.suse.com/1268989","tags":["report"]},{"url":"https://bugzilla.suse.com/1269512","tags":["report"]},{"url":"https://bugzilla.suse.com/1269513","tags":["report"]},{"url":"https://bugzilla.suse.com/1269798","tags":["report"]},{"url":"https://bugzilla.suse.com/1271011","tags":["report"]},{"url":"https://bugzilla.suse.com/1271866","tags":["report"]},{"url":"https://bugzilla.suse.com/1272573","tags":["report"]},{"url":"https://bugzilla.suse.com/1272665","tags":["report"]},{"url":"https://bugzilla.suse.com/1272693","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64530","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263616-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263617-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-21710","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21710","tags":["report"]},{"url":"https://git.kernel.org/linus/8c670bdfa58e48abad1d5b6ca1ee843ca91f7303","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7521-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7521-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7521-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7651-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7652-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7653-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7651-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7651-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7651-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7651-5","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7651-6","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7737-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-49570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-52559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-54456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-54458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-21710","title":"tcp: correct handling of extreme memory squeeze","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \"pasta\" protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn't influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side's notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u003e)\n//                tcp_rcv_established(-\u003e)\n[5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e)\n[5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-)\n[5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:       tcp_select_window(-\u003e)\n[5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n                        returning 0\n[5201\u003c-\u003e39222]:       tcp_select_window(\u003c-)\n[5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-)\n[5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-)\n[5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0]\n[5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()\n                    [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u003ercv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---","status":"published","published":"2025-02-27T02:07:23.112Z","modified":"2026-08-05T11:53:49.495Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:32:32.702673Z"}],"euvd":[{"id":"EUVD-2025-5241","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \"pasta\" protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn't influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side's notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u003e)\n//                tcp_rcv_established(-\u003e)\n[5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e)\n[5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-)\n[5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:       tcp_select_window(-\u003e)\n[5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n                        returning 0\n[5201\u003c-\u003e39222]:       tcp_select_window(\u003c-)\n[5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-)\n[5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-)\n[5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0]\n[5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()\n                    [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u003ercv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---","status":"published","published":"2025-02-27T02:07:23Z","modified":"2026-08-05T11:53:49Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:14.435051Z"}],"ghsa":[{"id":"GHSA-q383-xwj3-rcf5","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \"pasta\" protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn't influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side's notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u003e)\n//                tcp_rcv_established(-\u003e)\n[5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e)\n[5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-)\n[5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:       tcp_select_window(-\u003e)\n[5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n                        returning 0\n[5201\u003c-\u003e39222]:       tcp_select_window(\u003c-)\n[5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-)\n[5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-)\n[5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0]\n[5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()\n                    [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u003ercv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---","status":"published","published":"2025-02-27T03:34:01Z","modified":"2025-12-16T18:32:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T15:05:13.507882Z"}],"nvd":[{"id":"CVE-2025-21710","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \"pasta\" protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn't influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side's notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u003e)\n//                tcp_rcv_established(-\u003e)\n[5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e)\n[5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-)\n[5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:       tcp_select_window(-\u003e)\n[5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n                        returning 0\n[5201\u003c-\u003e39222]:       tcp_select_window(\u003c-)\n[5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-)\n[5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-)\n[5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0]\n[5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()\n                    [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u003ercv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---","status":"published","published":"2025-02-27T02:15:14.657Z","modified":"2026-07-30T06:20:26.45Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T14:10:51.871789Z"}],"osv":[{"id":"BELL-CVE-2025-21710","status":"published","published":"2025-02-28T05:57:09.579052Z","modified":"2026-06-25T07:18:21.345349796Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"CVE-2025-21710","title":"tcp: correct handling of extreme memory squeeze","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \"pasta\" protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn't influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side's notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u003e)\n//                tcp_rcv_established(-\u003e)\n[5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e)\n[5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-)\n[5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:       tcp_select_window(-\u003e)\n[5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE\n                        [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n                        returning 0\n[5201\u003c-\u003e39222]:       tcp_select_window(\u003c-)\n[5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-)\n[5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-)\n[5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0]\n[5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()\n                    [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u003ercv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e)\n[5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160\n[5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---","status":"published","published":"2025-02-27T02:07:23.112Z","modified":"2026-10-28T02:30:25.08330433Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"DEBIAN-CVE-2025-21710","description":"In the Linux kernel, the following vulnerability has been resolved:  tcp: correct handling of extreme memory squeeze  Testing with iperf3 using the \"pasta\" protocol splicer has revealed a problem in the way tcp handles window advertising in extreme memory squeeze situations.  Under memory pressure, a socket endpoint may temporarily advertise a zero-sized window, but this is not stored as part of the socket data. The reasoning behind this is that it is considered a temporary setting which shouldn't influence any further calculations.  However, if we happen to stall at an unfortunate value of the current window size, the algorithm selecting a new value will consistently fail to advertise a non-zero window once we have freed up enough memory. This means that this side's notion of the current window size is different from the one last advertised to the peer, causing the latter to not send any data to resolve the sitution.  The problem occurs on the iperf3 server side, and the socket in question is a completely regular socket with the default settings for the fedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.  The following excerpt of a logging session, with own comments added, shows more in detail what is happening:  //              tcp_v4_rcv(-\u003e) //                tcp_rcv_established(-\u003e) [5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ==== [5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e) [5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM                        [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]                        [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]                        [OFO queue: gap: 65480, len: 0] [5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-) [5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)                         [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160] [5201\u003c-\u003e39222]:       tcp_select_window(-\u003e) [5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE                         [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]                         returning 0 [5201\u003c-\u003e39222]:       tcp_select_window(\u003c-) [5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160 [5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-) [5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-) [5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-)  // Receive queue is at 85 buffers and we are out of memory. // We drop the incoming buffer, although it is in sequence, and decide // to send an advertisement with a window of zero. // We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means // we unconditionally shrink the window.  [5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e) [5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160 [5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368] [5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0] [5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()                     [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160] [5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)                   [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]                   [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]                   returning 6104 bytes [5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-)  // After each read, the algorithm for calculating the new receive // window in __tcp_cleanup_rbuf() finds it is too small to advertise // or to update tp-\u003ercv_wnd. // Meanwhile, the peer thinks the window is zero, and will not send // any more data to trigger an update from the interrupt mode side.  [5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e) [5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160 [5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n ---truncated---","status":"published","published":"2025-02-27T02:15:14.657Z","modified":"2026-09-01T20:05:42.106309515Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"OESA-2025-1339","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: fix a possible deadlock on radix_lock\n\nradix_lock() shouldn\u0026apos;t be held while holding dma_hash_entry[idx].lock\notherwise, there\u0026apos;s a possible deadlock scenario when\ndma debug API is called holding rq_lock():\n\nCPU0                   CPU1                       CPU2\ndma_free_attrs()\ncheck_unmap()          add_dma_entry()            __schedule() //out\n                                                  (A) rq_lock()\nget_hash_bucket()\n(A) dma_entry_hash\n                                                  check_sync()\n                       (A) radix_lock()           (W) dma_entry_hash\ndma_entry_free()\n(W) radix_lock()\n                       // CPU2\u0026apos;s one\n                       (W) rq_lock()\n\nCPU1 situation can happen when it extending radix tree and\nit tries to wake up kswapd via wake_all_kswapd().\n\nCPU2 situation can happen while perf_event_task_sched_out()\n(i.e. dma sync operation is called while deleting perf_event using\n etm and etr tmc which are Arm Coresight hwtracing driver backends).\n\nTo remove this possible situation, call dma_entry_free() after\nput_hash_bucket() in check_unmap().(CVE-2024-47143)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb-\u0026gt;lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.(CVE-2024-47809)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbcache: revert replacing IS_ERR_OR_NULL with IS_ERR again\n\nCommit 028ddcac477b (\u0026quot;bcache: Remove unnecessary NULL point check in\nnode allocations\u0026quot;) leads a NULL pointer deference in cache_set_flush().\n\n1721         if (!IS_ERR_OR_NULL(c-\u0026gt;root))\n1722                 list_add(\u0026amp;c-\u0026gt;root-\u0026gt;list, \u0026amp;c-\u0026gt;btree_cache);\n\n\u0026gt;From the above code in cache_set_flush(), if previous registration code\nfails before allocating c-\u0026gt;root, it is possible c-\u0026gt;root is NULL as what\nit is initialized. __bch_btree_node_alloc() never returns NULL but\nc-\u0026gt;root is possible to be NULL at above line 1721.\n\nThis patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.(CVE-2024-48881)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Properly hide first-in-list PCIe extended capability\n\nThere are cases where a PCIe extended capability should be hidden from\nthe user. For example, an unknown capability (i.e., capability with ID\ngreater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally\nchosen to be hidden from the user.\n\nHiding a capability is done by virtualizing and modifying the \u0026apos;Next\nCapability Offset\u0026apos; field of the previous capability so it points to the\ncapability after the one that should be hidden.\n\nThe special case where the first capability in the list should be hidden\nis handled differently because there is no previous capability that can\nbe modified. In this case, the capability ID and version are zeroed\nwhile leaving the next pointer intact. This hides the capability and\nleaves an anchor for the rest of the capability list.\n\nHowever, today, hiding the first capability in the list is not done\nproperly if the capability is unknown, as struct\nvfio_pci_core_device-\u0026gt;pci_config_map is set to the capability ID during\ninitialization but the capability ID is not properly checked later when\nused in vfio_config_do_rw(). This leads to the following warning [1] and\nto an out-of-bounds access to ecap_perms array.\n\nFix it by checking cap_id in vfio_config_do_rw(), and if it is greater\nthan PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct\nread only access instead of the ecap_perms array.\n\nNote that this is safe since the above is the only case where cap_id can\nexceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which\nare already checked before).\n\n[1]\n\nWARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]\nCPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1\n(snip)\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x69/0x80\n ? __warn+0x8d/0x140\n ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]\n ? report_bug+0x18f/0x1a0\n ? handle_bug+0x63/0xa0\n ? exc_invalid_op+0x19/0x70\n ? asm_exc_invalid_op+0x1b/0x20\n ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]\n ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core]\n vfio_pci_rw+0x101/0x1b0 [vfio_pci_core]\n vfio_pci_core_read+0x1d/0x30 [vfio_pci_core]\n vfio_device_fops_read+0x27/0x40 [vfio]\n vfs_read+0xbd/0x340\n ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio]\n ? __rseq_handle_notify_resume+0xa4/0x4b0\n __x64_sys_pread64+0x96/0xc0\n x64_sys_call+0x1c3d/0x20d0\n do_syscall_64+0x4d/0x120\n entry_SYSCALL_64_after_hwframe+0x76/0x7e(CVE-2024-53214)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_can: do not leave a dangling sk pointer in can_create()\n\nOn error can_create() frees the allocated sk object, but sock_init_data()\nhas already attached it to the provided sock object. This will leave a\ndangling sk pointer in the sock object and may cause use-after-free later.(CVE-2024-56603)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: avoid erroring out after sock_init_data() in packet_create()\n\nAfter sock_init_data() the allocated sk object is attached to the provided\nsock object. On error, packet_create() frees the sk object leaving the\ndangling pointer in the sock object on return. Some other code may try\nto use this pointer and cause use-after-free.(CVE-2024-56606)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Hold module reference while requesting a module\n\nUser space may unload ip_set.ko while it is itself requesting a set type\nbackend module, leading to a kernel crash. The race condition may be\nprovoked by inserting an mdelay() right after the nfnl_unlock() call.(CVE-2024-56637)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free of kernel socket in cleanup_bearer().\n\nsyzkaller reported a use-after-free of UDP kernel socket\nin cleanup_bearer() without repro. [0][1]\n\nWhen bearer_disable() calls tipc_udp_disable(), cleanup\nof the UDP kernel socket is deferred by work calling\ncleanup_bearer().\n\ntipc_exit_net() waits for such works to finish by checking\ntipc_net(net)-\u0026gt;wq_count.  However, the work decrements the\ncount too early before releasing the kernel socket,\nunblocking cleanup_net() and resulting in use-after-free.\n\nLet\u0026apos;s move the decrement after releasing the socket in\ncleanup_bearer().\n\n[0]:\nref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at\n     sk_alloc+0x438/0x608\n     inet_create+0x4c8/0xcb0\n     __sock_create+0x350/0x6b8\n     sock_create_kern+0x58/0x78\n     udp_sock_create4+0x68/0x398\n     udp_sock_create+0x88/0xc8\n     tipc_udp_enable+0x5e8/0x848\n     __tipc_nl_bearer_enable+0x84c/0xed8\n     tipc_nl_bearer_enable+0x38/0x60\n     genl_family_rcv_msg_doit+0x170/0x248\n     genl_rcv_msg+0x400/0x5b0\n     netlink_rcv_skb+0x1dc/0x398\n     genl_rcv+0x44/0x68\n     netlink_unicast+0x678/0x8b0\n     netlink_sendmsg+0x5e4/0x898\n     ____sys_sendmsg+0x500/0x830\n\n[1]:\nBUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline]\nBUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979\n udp_hashslot include/net/udp.h:85 [inline]\n udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979\n sk_common_release+0xaf/0x3f0 net/core/sock.c:3820\n inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437\n inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489\n __sock_release net/socket.c:658 [inline]\n sock_release+0xa0/0x210 net/socket.c:686\n cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310\n worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391\n kthread+0x531/0x6b0 kernel/kthread.c:389\n ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244\n\nUninit was created at:\n slab_free_hook mm/slub.c:2269 [inline]\n slab_free mm/slub.c:4580 [inline]\n kmem_cache_free+0x207/0xc40 mm/slub.c:4682\n net_free net/core/net_namespace.c:454 [inline]\n cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310\n worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391\n kthread+0x531/0x6b0 kernel/kthread.c:389\n ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244\n\nCPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: events cleanup_bearer(CVE-2024-56642)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: avoid potential out-of-bound access in fill_frame_info()\n\nsyzbot is able to feed a packet with 14 bytes, pretending\nit is a vlan one.\n\nSince fill_frame_info() is relying on skb-\u0026gt;mac_len already,\nextend the check to cover this case.\n\nBUG: KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:709 [inline]\n BUG: KMSAN: uninit-value in hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724\n  fill_frame_info net/hsr/hsr_forward.c:709 [inline]\n  hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724\n  hsr_dev_xmit+0x2f0/0x350 net/hsr/hsr_device.c:235\n  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n  xmit_one net/core/dev.c:3590 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3606\n  __dev_queue_xmit+0x366a/0x57d0 net/core/dev.c:4434\n  dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3146 [inline]\n  packet_sendmsg+0x91ae/0xa6f0 net/packet/af_packet.c:3178\n  sock_sendmsg_nosec net/socket.c:711 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:726\n  __sys_sendto+0x594/0x750 net/socket.c:2197\n  __do_sys_sendto net/socket.c:2204 [inline]\n  __se_sys_sendto net/socket.c:2200 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200\n  x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4091 [inline]\n  slab_alloc_node mm/slub.c:4134 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1323 [inline]\n  alloc_skb_with_frags+0xc8/0xd00 net/core/skbuff.c:6612\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2881\n  packet_alloc_skb net/packet/af_packet.c:2995 [inline]\n  packet_snd net/packet/af_packet.c:3089 [inline]\n  packet_sendmsg+0x74c6/0xa6f0 net/packet/af_packet.c:3178\n  sock_sendmsg_nosec net/socket.c:711 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:726\n  __sys_sendto+0x594/0x750 net/socket.c:2197\n  __do_sys_sendto net/socket.c:2204 [inline]\n  __se_sys_sendto net/socket.c:2200 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200\n  x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-56648)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer\n\nConsidering that in some extreme cases,\nwhen u_serial driver is accessed by multiple threads,\nThread A is executing the open operation and calling the gs_open,\nThread B is executing the disconnect operation and calling the\ngserial_disconnect function,The port-\u0026gt;port_usb pointer will be set to NULL.\n\nE.g.\n    Thread A                                 Thread B\n    gs_open()                                gadget_unbind_driver()\n    gs_start_io()                            composite_disconnect()\n    gs_start_rx()                            gserial_disconnect()\n    ...                                      ...\n    spin_unlock(\u0026amp;port-\u0026gt;port_lock)\n    status = usb_ep_queue()                  spin_lock(\u0026amp;port-\u0026gt;port_lock)\n    spin_lock(\u0026amp;port-\u0026gt;port_lock)              port-\u0026gt;port_usb = NULL\n    gs_free_requests(port-\u0026gt;port_usb-\u0026gt;in)     spin_unlock(\u0026amp;port-\u0026gt;port_lock)\n    Crash\n\nThis causes thread A to access a null pointer (port-\u0026gt;port_usb is null)\nwhen calling the gs_free_requests function, causing a crash.\n\nIf port_usb is NULL, the release request will be skipped as it\nwill be done by gserial_disconnect.\n\nSo add a null pointer check to gs_start_io before attempting\nto access the value of the pointer port-\u0026gt;port_usb.\n\nCall trace:\n gs_start_io+0x164/0x25c\n gs_open+0x108/0x13c\n tty_open+0x314/0x638\n chrdev_open+0x1b8/0x258\n do_dentry_open+0x2c4/0x700\n vfs_open+0x2c/0x3c\n path_openat+0xa64/0xc60\n do_filp_open+0xb8/0x164\n do_sys_openat2+0x84/0xf0\n __arm64_sys_openat+0x70/0x9c\n invoke_syscall+0x58/0x114\n el0_svc_common+0x80/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x38/0x68(CVE-2024-56670)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\n9p/xen: fix release of IRQ\n\nKernel logs indicate an IRQ was double-freed.\n\nPass correct device ID during IRQ release.\n\n[Dominique: remove confusing variable reset to 0](CVE-2024-56704)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level\n\ncgroup maximum depth is INT_MAX by default, there is a cgroup toggle to\nrestrict this maximum depth to a more reasonable value not to harm\nperformance. Remove unnecessary WARN_ON_ONCE which is reachable from\nuserspace.(CVE-2024-56783)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a\n\nFix the dtc warnings:\n\n    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: \u0026apos;#interrupt-cells\u0026apos; found, but node is not an interrupt provider\n    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: \u0026apos;#interrupt-cells\u0026apos; found, but node is not an interrupt provider\n    arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite \u0026apos;interrupt_provider\u0026apos;\n\nAnd a runtime warning introduced in commit 045b14ca5c36 (\u0026quot;of: WARN on\ndeprecated #address-cells/#size-cells handling\u0026quot;):\n\n    WARNING: CPU: 0 PID: 1 at drivers/of/base.c:106 of_bus_n_addr_cells+0x9c/0xe0\n    Missing \u0026apos;#address-cells\u0026apos; in /bus@10000000/pci@1a000000/pci_bridge@9,0\n\nThe fix is similar to commit d89a415ff8d5 (\u0026quot;MIPS: Loongson64: DTS: Fix PCIe\nport nodes for ls7a\u0026quot;), which has fixed the issue for ls2k (despite its\nsubject mentions ls7a).(CVE-2024-56785)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/entry: Mark IRQ entries to fix stack depot warnings\n\nThe stack depot filters out everything outside of the top interrupt\ncontext as an uninteresting or irrelevant part of the stack traces. This\nhelps with stack trace de-duplication, avoiding an explosion of saved\nstack traces that share the same IRQ context code path but originate\nfrom different randomly interrupted points, eventually exhausting the\nstack depot.\n\nFiltering uses in_irqentry_text() to identify functions within the\n.irqentry.text and .softirqentry.text sections, which then become the\nlast stack trace entries being saved.\n\nWhile __do_softirq() is placed into the .softirqentry.text section by\ncommon code, populating .irqentry.text is architecture-specific.\n\nCurrently, the .irqentry.text section on s390 is empty, which prevents\nstack depot filtering and de-duplication and could result in warnings\nlike:\n\nStack depot reached limit capacity\nWARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8\n\nwith PREEMPT and KASAN enabled.\n\nFix this by moving the IO/EXT interrupt handlers from .kprobes.text into\nthe .irqentry.text section and updating the kprobes blacklist to include\nthe .irqentry.text section.\n\nThis is done only for asynchronous interrupts and explicitly not for\nprogram checks, which are synchronous and where the context beyond the\nprogram check is important to preserve. Despite machine checks being\nsomewhat in between, they are extremely rare, and preserving context\nwhen possible is also of value.\n\nSVCs and Restart Interrupts are not relevant, one being always at the\nboundary to user space and the other being a one-time thing.\n\nIRQ entries filtering is also optionally used in ftrace function graph,\nwhere the same logic applies.(CVE-2024-57838)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Fix resetting msg rx state after topology removal\n\nIf the MST topology is removed during the reception of an MST down reply\nor MST up request sideband message, the\ndrm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset\nfrom one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with\nthe reading/parsing of the message from another thread via\ndrm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is\npossible since the reader/parser doesn\u0026apos;t hold any lock while accessing\nthe reception state. This in turn can lead to a memory corruption in the\nreader/parser as described by commit bd2fccac61b4 (\u0026quot;drm/dp_mst: Fix MST\nsideband message body length check\u0026quot;).\n\nFix the above by resetting the message reception state if needed before\nreading/parsing a message. Another solution would be to hold the\ndrm_dp_mst_topology_mgr::lock for the whole duration of the message\nreception/parsing in drm_dp_mst_handle_down_rep() and\ndrm_dp_mst_handle_up_req(), however this would require a bigger change.\nSince the fix is also needed for stable, opting for the simpler solution\nin this patch.(CVE-2024-57876)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrdma/cxgb4: Prevent potential integer overflow on 32bit\n\nThe \u0026quot;gl-\u0026gt;tot_len\u0026quot; variable is controlled by the user.  It comes from\nprocess_responses().  On 32bit systems, the \u0026quot;gl-\u0026gt;tot_len + sizeof(struct\ncpl_pass_accept_req) + sizeof(struct rss_header)\u0026quot; addition could have an\ninteger wrapping bug.  Use size_add() to prevent this.(CVE-2024-57973)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imx-jpeg: Fix potential error pointer dereference in detach_pm()\n\nThe proble is on the first line:\n\n\tif (jpeg-\u0026gt;pd_dev[i] \u0026amp;\u0026amp; !pm_runtime_suspended(jpeg-\u0026gt;pd_dev[i]))\n\nIf jpeg-\u0026gt;pd_dev[i] is an error pointer, then passing it to\npm_runtime_suspended() will lead to an Oops.  The other conditions\ncheck for both error pointers and NULL, but it would be more clear to\nuse the IS_ERR_OR_NULL() check for that.(CVE-2024-57978)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix assumption that Resolution Multipliers must be in Logical Collections\n\nA report in 2019 by the syzbot fuzzer was found to be connected to two\nerrors in the HID core associated with Resolution Multipliers.  One of\nthe errors was fixed by commit ea427a222d8b (\u0026quot;HID: core: Fix deadloop\nin hid_apply_multiplier.\u0026quot;), but the other has not been fixed.\n\nThis error arises because hid_apply_multipler() assumes that every\nResolution Multiplier control is contained in a Logical Collection,\ni.e., there\u0026apos;s no way the routine can ever set multiplier_collection to\nNULL.  This is in spite of the fact that the function starts with a\nbig comment saying:\n\n\t * \u0026quot;The Resolution Multiplier control must be contained in the same\n\t * Logical Collection as the control(s) to which it is to be applied.\n\t   ...\n\t *  If no Logical Collection is\n\t * defined, the Resolution Multiplier is associated with all\n\t * controls in the report.\u0026quot;\n\t * HID Usage Table, v1.12, Section 4.3.1, p30\n\t *\n\t * Thus, search from the current collection upwards until we find a\n\t * logical collection...\n\nThe comment and the code overlook the possibility that none of the\ncollections found may be a Logical Collection.\n\nThe fix is to set the multiplier_collection pointer to NULL if the\ncollection found isn\u0026apos;t a Logical Collection.(CVE-2024-57986)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check\n\nsyzbot has found a type mismatch between a USB pipe and the transfer\nendpoint, which is triggered by the hid-thrustmaster driver[1].\nThere is a number of similar, already fixed issues [2].\nIn this case as in others, implementing check for endpoint type fixes the issue.\n\n[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470\n[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622(CVE-2024-57993)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: fix channel survey memory allocation size\n\nKASAN reported a memory allocation issue in wcn-\u0026gt;chan_survey\ndue to incorrect size calculation.\nThis commit uses kcalloc to allocate memory for wcn-\u0026gt;chan_survey,\nensuring proper initialization and preventing the use of uninitialized\nvalues when there are no frames on the channel.(CVE-2024-57997)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nOPP: add index check to assert to avoid buffer overflow in _read_freq()\n\nPass the freq index to the assert function to make sure\nwe do not read a freq out of the opp-\u0026gt;rates[] table when called\nfrom the indexed variants:\ndev_pm_opp_find_freq_exact_indexed() or\ndev_pm_opp_find_freq_ceil/floor_indexed().\n\nAdd a secondary parameter to the assert function, unused\nfor assert_single_clk() then add assert_clk_index() which\nwill check for the clock index when called from the _indexed()\nfind functions.(CVE-2024-57998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\n\nIn commit 4284c88fff0e (\u0026quot;PCI: designware-ep: Allow pci_epc_set_bar() update\ninbound map address\u0026quot;) set_bar() was modified to support dynamically\nchanging the backing physical address of a BAR that was already configured.\n\nThis means that set_bar() can be called twice, without ever calling\nclear_bar() (as calling clear_bar() would clear the BAR\u0026apos;s PCI address\nassigned by the host).\n\nThis can only be done if the new BAR size/flags does not differ from the\nexisting BAR configuration. Add these missing checks.\n\nIf we allow set_bar() to set e.g. a new BAR size that differs from the\nexisting BAR size, the new address translation range will be smaller than\nthe BAR size already determined by the host, which would mean that a read\npast the new BAR size would pass the iATU untranslated, which could allow\nthe host to read memory not belonging to the new struct pci_epf_bar.\n\nWhile at it, add comments which clarifies the support for dynamically\nchanging the physical address of a BAR. (Which was also missing.)(CVE-2024-58006)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()\n\nAs of_find_node_by_name() release the reference of the argument device\nnode, tegra_emc_find_node_by_ram_code() releases some device nodes while\nstill in use, resulting in possible UAFs. According to the bindings and\nthe in-tree DTS files, the \u0026quot;emc-tables\u0026quot; node is always device\u0026apos;s child\nnode with the property \u0026quot;nvidia,use-ram-code\u0026quot;, and the \u0026quot;lpddr2\u0026quot; node is a\nchild of the \u0026quot;emc-tables\u0026quot; node. Thus utilize the\nfor_each_child_of_node() macro and of_get_child_by_name() instead of\nof_find_node_by_name() to simplify the code.\n\nThis bug was found by an experimental verification tool that I am\ndeveloping.\n\n[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts](CVE-2024-58034)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: Add check devm_kasprintf() returned value\n\ndevm_kasprintf() can return a NULL pointer on failure but this\nreturned value is not checked.(CVE-2024-58051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table\n\nThe function atomctrl_get_smc_sclk_range_table() does not check the return\nvalue of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to\nretrieve SMU_Info table, it returns NULL which is later dereferenced.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nIn practice this should never happen as this code only gets called\non polaris chips and the vbios data table will always be present on\nthose chips.(CVE-2024-58052)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we\u0026apos;ve received.  Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection.  Whilst the propagation bit is performed, the calls aren\u0026apos;t then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts.(CVE-2024-58053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: max96712: fix kernel oops when removing module\n\nThe following kernel oops is thrown when trying to remove the max96712\nmodule:\n\nUnable to handle kernel paging request at virtual address 00007375746174db\nMem abort info:\n  ESR = 0x0000000096000004\n  EC = 0x25: DABT (current EL), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x04: level 0 translation fault\nData abort info:\n  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n  CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=000000010af89000\n[00007375746174db] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] PREEMPT SMP\nModules linked in: crct10dif_ce polyval_ce mxc_jpeg_encdec flexcan\n    snd_soc_fsl_sai snd_soc_fsl_asoc_card snd_soc_fsl_micfil dwc_mipi_csi2\n    imx_csi_formatter polyval_generic v4l2_jpeg imx_pcm_dma can_dev\n    snd_soc_imx_audmux snd_soc_wm8962 snd_soc_imx_card snd_soc_fsl_utils\n    max96712(C-) rpmsg_ctrl rpmsg_char pwm_fan fuse\n    [last unloaded: imx8_isi]\nCPU: 0 UID: 0 PID: 754 Comm: rmmod\n\t    Tainted: G         C    6.12.0-rc6-06364-g327fec852c31 #17\nTainted: [C]=CRAP\nHardware name: NXP i.MX95 19X19 board (DT)\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : led_put+0x1c/0x40\nlr : v4l2_subdev_put_privacy_led+0x48/0x58\nsp : ffff80008699bbb0\nx29: ffff80008699bbb0 x28: ffff00008ac233c0 x27: 0000000000000000\nx26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff000080cf1170 x22: ffff00008b53bd00 x21: ffff8000822ad1c8\nx20: ffff000080ff5c00 x19: ffff00008b53be40 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000004 x13: ffff0000800f8010 x12: 0000000000000000\nx11: ffff000082acf5c0 x10: ffff000082acf478 x9 : ffff0000800f8010\nx8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d\nx5 : 8080808000000000 x4 : 0000000000000020 x3 : 00000000553a3dc1\nx2 : ffff00008ac233c0 x1 : ffff00008ac233c0 x0 : ff00737574617473\nCall trace:\n led_put+0x1c/0x40\n v4l2_subdev_put_privacy_led+0x48/0x58\n v4l2_async_unregister_subdev+0x2c/0x1a4\n max96712_remove+0x1c/0x38 [max96712]\n i2c_device_remove+0x2c/0x9c\n device_remove+0x4c/0x80\n device_release_driver_internal+0x1cc/0x228\n driver_detach+0x4c/0x98\n bus_remove_driver+0x6c/0xbc\n driver_unregister+0x30/0x60\n i2c_del_driver+0x54/0x64\n max96712_i2c_driver_exit+0x18/0x1d0 [max96712]\n __arm64_sys_delete_module+0x1a4/0x290\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x34/0xd8\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x190/0x194\nCode: f9000bf3 aa0003f3 f9402800 f9402000 (f9403400)\n---[ end trace 0000000000000000 ]---\n\nThis happens because in v4l2_i2c_subdev_init(), the i2c_set_cliendata()\nis called again and the data is overwritten to point to sd, instead of\npriv. So, in remove(), the wrong pointer is passed to\nv4l2_async_unregister_subdev(), leading to a crash.(CVE-2024-58054)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: core: Fix ida_free call while not allocated\n\nIn the rproc_alloc() function, on error, put_device(\u0026amp;rproc-\u0026gt;dev) is\ncalled, leading to the call of the rproc_type_release() function.\nAn error can occurs before ida_alloc is called.\n\nIn such case in rproc_type_release(), the condition (rproc-\u0026gt;index \u0026gt;= 0) is\ntrue as rproc-\u0026gt;index has been  initialized to 0.\nida_free() is called reporting a warning:\n[    4.181906] WARNING: CPU: 1 PID: 24 at lib/idr.c:525 ida_free+0x100/0x164\n[    4.186378] stm32-display-dsi 5a000000.dsi: Fixed dependency cycle(s) with /soc/dsi@5a000000/panel@0\n[    4.188854] ida_free called for id=0 which is not allocated.\n[    4.198256] mipi-dsi 5a000000.dsi.0: Fixed dependency cycle(s) with /soc/dsi@5a000000\n[    4.203556] Modules linked in: panel_orisetech_otm8009a dw_mipi_dsi_stm(+) gpu_sched dw_mipi_dsi stm32_rproc stm32_crc32 stm32_ipcc(+) optee(+)\n[    4.224307] CPU: 1 UID: 0 PID: 24 Comm: kworker/u10:0 Not tainted 6.12.0 #442\n[    4.231481] Hardware name: STM32 (Device Tree Support)\n[    4.236627] Workqueue: events_unbound deferred_probe_work_func\n[    4.242504] Call trace:\n[    4.242522]  unwind_backtrace from show_stack+0x10/0x14\n[    4.250218]  show_stack from dump_stack_lvl+0x50/0x64\n[    4.255274]  dump_stack_lvl from __warn+0x80/0x12c\n[    4.260134]  __warn from warn_slowpath_fmt+0x114/0x188\n[    4.265199]  warn_slowpath_fmt from ida_free+0x100/0x164\n[    4.270565]  ida_free from rproc_type_release+0x38/0x60\n[    4.275832]  rproc_type_release from device_release+0x30/0xa0\n[    4.281601]  device_release from kobject_put+0xc4/0x294\n[    4.286762]  kobject_put from rproc_alloc.part.0+0x208/0x28c\n[    4.292430]  rproc_alloc.part.0 from devm_rproc_alloc+0x80/0xc4\n[    4.298393]  devm_rproc_alloc from stm32_rproc_probe+0xd0/0x844 [stm32_rproc]\n[    4.305575]  stm32_rproc_probe [stm32_rproc] from platform_probe+0x5c/0xbc\n\nCalling ida_alloc earlier in rproc_alloc ensures that the rproc-\u0026gt;index is\nproperly set.(CVE-2024-58056)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nubifs: skip dumping tnc tree when zroot is null\n\nClearing slab cache will free all znode in memory and make\nc-\u0026gt;zroot.znode = NULL, then dumping tnc tree will access\nc-\u0026gt;zroot.znode which cause null pointer dereference.(CVE-2024-58058)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: prohibit deactivating all links\n\nIn the internal API this calls this is a WARN_ON, but that\nshould remain since internally we want to know about bugs\nthat may cause this. Prevent deactivating all links in the\ndebugfs write directly.(CVE-2024-58061)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: fix memory leaks and invalid access at probe error path\n\nDeinitialize at reverse order when probe fails.\n\nWhen init_sw_vars fails, rtl_deinit_core should not be called, specially\nnow that it destroys the rtl_wq workqueue.\n\nAnd call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be\nleaked.\n\nRemove pci_set_drvdata call as it will already be cleaned up by the core\ndriver code and could lead to memory leaks too. cf. commit 8d450935ae7f\n(\u0026quot;wireless: rtlwifi: remove unnecessary pci_set_drvdata()\u0026quot;) and\ncommit 3d86b93064c7 (\u0026quot;rtlwifi: Fix PCI probe error path orphaned memory\u0026quot;).(CVE-2024-58063)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nOPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized\n\nIf a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth\nfrom the OPP table but the bandwidth table was not created because the\ninterconnect properties were missing in the OPP consumer node, the\nkernel will crash with:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n...\npc : _read_bw+0x8/0x10\nlr : _opp_table_find_key+0x9c/0x174\n...\nCall trace:\n  _read_bw+0x8/0x10 (P)\n  _opp_table_find_key+0x9c/0x174 (L)\n  _find_key+0x98/0x168\n  dev_pm_opp_find_bw_ceil+0x50/0x88\n...\n\nIn order to fix the crash, create an assert function to check\nif the bandwidth table was created before trying to get a\nbandwidth with _read_bw().(CVE-2024-58068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: prevent adding a device which is already a team device lower\n\nPrevent adding a device which is already a team device lower,\ne.g. adding veth0 if vlan1 was already added and veth0 is a lower of\nvlan1.\n\nThis is not useful in practice and can lead to recursive locking:\n\n$ ip link add veth0 type veth peer name veth1\n$ ip link set veth0 up\n$ ip link set veth1 up\n$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1\n$ ip link add team0 type team\n$ ip link set veth0.1 down\n$ ip link set veth0.1 master team0\nteam0: Port device veth0.1 added\n$ ip link set veth0 down\n$ ip link set veth0 master team0\n\n============================================\nWARNING: possible recursive locking detected\n6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted\n--------------------------------------------\nip/7684 is trying to acquire lock:\nffff888016848e00 (team-\u0026gt;team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n\nbut task is already holding lock:\nffff888016848e00 (team-\u0026gt;team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977)\n\nother info that might help us debug this:\nPossible unsafe locking scenario:\n\nCPU0\n----\nlock(team-\u0026gt;team_lock_key);\nlock(team-\u0026gt;team_lock_key);\n\n*** DEADLOCK ***\n\nMay be due to missing lock nesting notation\n\n2 locks held by ip/7684:\n\nstack backtrace:\nCPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n\u0026lt;TASK\u0026gt;\ndump_stack_lvl (lib/dump_stack.c:122)\nprint_deadlock_bug.cold (kernel/locking/lockdep.c:3040)\n__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226)\n? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548)\nlock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2))\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? lock_acquire (kernel/locking/lockdep.c:5822)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? fib_sync_up (net/ipv4/fib_semantics.c:2167)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\nteam_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\nnotifier_call_chain (kernel/notifier.c:85)\ncall_netdevice_notifiers_info (net/core/dev.c:1996)\n__dev_notify_flags (net/core/dev.c:8993)\n? __dev_change_flags (net/core/dev.c:8975)\ndev_change_flags (net/core/dev.c:9027)\nvlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470)\n? br_device_event (net/bridge/br.c:143)\nnotifier_call_chain (kernel/notifier.c:85)\ncall_netdevice_notifiers_info (net/core/dev.c:1996)\ndev_open (net/core/dev.c:1519 net/core/dev.c:1505)\nteam_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977)\n? __pfx_team_add_slave (drivers/net/team/team_core.c:1972)\ndo_set_master (net/core/rtnetlink.c:2917)\ndo_setlink.isra.0 (net/core/rtnetlink.c:3117)(CVE-2024-58071)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: remove unused check_buddy_priv\n\nCommit 2461c7d60f9f (\u0026quot;rtlwifi: Update header file\u0026quot;) introduced a global\nlist of private data structures.\n\nLater on, commit 26634c4b1868 (\u0026quot;rtlwifi Modify existing bits to match\nvendor version 2013.02.07\u0026quot;) started adding the private data to that list at\nprobe time and added a hook, check_buddy_priv to find the private data from\na similar device.\n\nHowever, that function was never used.\n\nBesides, though there is a lock for that list, it is never used. And when\nthe probe fails, the private data is never removed from the list. This\nwould cause a second probe to access freed memory.\n\nRemove the unused hook, structures and members, which will prevent the\npotential race condition on the list and its corruption during a second\nprobe when probe fails.(CVE-2024-58072)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvfio/platform: check the bounds of read/write syscalls\n\ncount and offset are passed from user space and not checked, only\noffset is capped to 40 bits, which can be used to read/write out of\nbounds of the device.(CVE-2025-21687)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: handle fastopen disconnect correctly\n\nSyzbot was able to trigger a data stream corruption:\n\n  WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 __mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 9846 Comm: syz-executor351 Not tainted 6.13.0-rc2-syzkaller-00059-g00a5acdbf398 #0\n  Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024\n  RIP: 0010:__mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024\n  Code: fa ff ff 48 8b 4c 24 18 80 e1 07 fe c1 38 c1 0f 8c 8e fa ff ff 48 8b 7c 24 18 e8 e0 db 54 f6 e9 7f fa ff ff e8 e6 80 ee f5 90 \u0026lt;0f\u0026gt; 0b 90 4c 8b 6c 24 40 4d 89 f4 e9 04 f5 ff ff 44 89 f1 80 e1 07\n  RSP: 0018:ffffc9000c0cf400 EFLAGS: 00010293\n  RAX: ffffffff8bb0dd5a RBX: ffff888033f5d230 RCX: ffff888059ce8000\n  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n  RBP: ffffc9000c0cf518 R08: ffffffff8bb0d1dd R09: 1ffff110170c8928\n  R10: dffffc0000000000 R11: ffffed10170c8929 R12: 0000000000000000\n  R13: ffff888033f5d220 R14: dffffc0000000000 R15: ffff8880592b8000\n  FS:  00007f6e866496c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f6e86f491a0 CR3: 00000000310e6000 CR4: 00000000003526f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __mptcp_clean_una_wakeup+0x7f/0x2d0 net/mptcp/protocol.c:1074\n   mptcp_release_cb+0x7cb/0xb30 net/mptcp/protocol.c:3493\n   release_sock+0x1aa/0x1f0 net/core/sock.c:3640\n   inet_wait_for_connect net/ipv4/af_inet.c:609 [inline]\n   __inet_stream_connect+0x8bd/0xf30 net/ipv4/af_inet.c:703\n   mptcp_sendmsg_fastopen+0x2a2/0x530 net/mptcp/protocol.c:1755\n   mptcp_sendmsg+0x1884/0x1b10 net/mptcp/protocol.c:1830\n   sock_sendmsg_nosec net/socket.c:711 [inline]\n   __sock_sendmsg+0x1a6/0x270 net/socket.c:726\n   ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\n   ___sys_sendmsg net/socket.c:2637 [inline]\n   __sys_sendmsg+0x269/0x350 net/socket.c:2669\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x7f6e86ebfe69\n  Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n  RSP: 002b:00007f6e86649168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n  RAX: ffffffffffffffda RBX: 00007f6e86f491b8 RCX: 00007f6e86ebfe69\n  RDX: 0000000030004001 RSI: 0000000020000080 RDI: 0000000000000003\n  RBP: 00007f6e86f491b0 R08: 00007f6e866496c0 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6e86f491bc\n  R13: 000000000000006e R14: 00007ffe445d9420 R15: 00007ffe445d9508\n   \u0026lt;/TASK\u0026gt;\n\nThe root cause is the bad handling of disconnect() generated internally\nby the MPTCP protocol in case of connect FASTOPEN errors.\n\nAddress the issue increasing the socket disconnect counter even on such\na case, to allow other threads waiting on the same socket lock to\nproperly error out.(CVE-2025-21705)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: consolidate suboption status\n\nMPTCP maintains the received sub-options status is the bitmask carrying\nthe received suboptions and in several bitfields carrying per suboption\nadditional info.\n\nZeroing the bitmask before parsing is not enough to ensure a consistent\nstatus, and the MPTCP code has to additionally clear some bitfiled\ndepending on the actually parsed suboption.\n\nThe above schema is fragile, and syzbot managed to trigger a path where\na relevant bitfield is not cleared/initialized:\n\n  BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline]\n  BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline]\n  BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline]\n  BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209\n   __mptcp_expand_seq net/mptcp/options.c:1030 [inline]\n   mptcp_expand_seq net/mptcp/protocol.h:864 [inline]\n   ack_update_msk net/mptcp/options.c:1060 [inline]\n   mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209\n   tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233\n   tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264\n   tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916\n   tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351\n   ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205\n   ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233\n   NF_HOOK include/linux/netfilter.h:314 [inline]\n   ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n   dst_input include/net/dst.h:460 [inline]\n   ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447\n   NF_HOOK include/linux/netfilter.h:314 [inline]\n   ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567\n   __netif_receive_skb_one_core net/core/dev.c:5704 [inline]\n   __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817\n   process_backlog+0x4ad/0xa50 net/core/dev.c:6149\n   __napi_poll+0xe7/0x980 net/core/dev.c:6902\n   napi_poll net/core/dev.c:6971 [inline]\n   net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093\n   handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561\n   __do_softirq+0x14/0x1a kernel/softirq.c:595\n   do_softirq+0x9a/0x100 kernel/softirq.c:462\n   __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389\n   local_bh_enable include/linux/bottom_half.h:33 [inline]\n   rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]\n   __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493\n   dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n   neigh_hh_output include/net/neighbour.h:523 [inline]\n   neigh_output include/net/neighbour.h:537 [inline]\n   ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236\n   __ip_finish_output+0x287/0x810\n   ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324\n   NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n   ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434\n   dst_output include/net/dst.h:450 [inline]\n   ip_local_out net/ipv4/ip_output.c:130 [inline]\n   __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536\n   ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550\n   __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468\n   tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline]\n   tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829\n   __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012\n   tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618\n   __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130\n   __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496\n   mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550\n   mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889\n   mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline]\n   mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline]\n   mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline]\n   mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750\n   genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n \n---truncated---(CVE-2025-21707)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: enable basic endpoint checking\n\nSyzkaller reports [1] encountering a common issue of utilizing a wrong\nusb endpoint type during URB submitting stage. This, in turn, triggers\na warning shown below.\n\nFor now, enable simple endpoint checking (specifically, bulk and\ninterrupt eps, testing control one is not essential) to mitigate\nthe issue with a view to do other related cosmetic changes later,\nif they are necessary.\n\n[1] Syzkaller report:\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv\u0026gt;\nModules linked in:\nCPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617\u0026gt;\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\nCode: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8\u0026gt;\nRSP: 0018:ffffc9000441f740 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9\nRDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001\nRBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c\nFS:  00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733\n __dev_open+0x2d4/0x4e0 net/core/dev.c:1474\n __dev_change_flags+0x561/0x720 net/core/dev.c:8838\n dev_change_flags+0x8f/0x160 net/core/dev.c:8910\n devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177\n inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003\n sock_do_ioctl+0x116/0x280 net/socket.c:1222\n sock_ioctl+0x22e/0x6c0 net/socket.c:1341\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl fs/ioctl.c:893 [inline]\n __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fc04ef73d49\n...\n\nThis change has not been tested on real hardware.(CVE-2025-21708)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \u0026quot;pasta\u0026quot; protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn\u0026apos;t influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side\u0026apos;s notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u0026gt;)\n//                tcp_rcv_established(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u0026lt;-\u0026gt;39222]:     tcp_data_queue(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u0026gt;260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u0026lt;-\u0026gt;39222]:     tcp_data_queue(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]:     __tcp_transmit_skb(-\u0026gt;)\n                        [tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160]\n[5201\u0026lt;-\u0026gt;39222]:       tcp_select_window(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:         (inet_csk(sk)-\u0026gt;icsk_ack.pending \u0026amp; ICSK_ACK_NOMEM) ? --\u0026gt; TRUE\n                        [tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160]\n                        returning 0\n[5201\u0026lt;-\u0026gt;39222]:       tcp_select_window(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u0026lt;-\u0026gt;39222]:     [__tcp_transmit_skb(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]:   tcp_rcv_established(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]: tcp_v4_rcv(\u0026lt;-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don\u0026apos;t update tp-\u0026gt;rcv_wnd and tp-\u0026gt;rcv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u0026lt;-\u0026gt;39222]: tcp_recvmsg_locked(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:   __tcp_cleanup_rbuf(-\u0026gt;) tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160\n[5201\u0026lt;-\u0026gt;39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u0026lt;-\u0026gt;39222]:     [new_win \u0026gt;= (2 * win_now) ? --\u0026gt; time_to_ack = 0]\n[5201\u0026lt;-\u0026gt;39222]:     NOT calling tcp_send_ack()\n                    [tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160]\n[5201\u0026lt;-\u0026gt;39222]:   __tcp_cleanup_rbuf(\u0026lt;-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u0026gt;260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u0026lt;-\u0026gt;39222]: tcp_recvmsg_locked(\u0026lt;-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u0026gt;rcv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u0026lt;-\u0026gt;39222]: tcp_recvmsg_locked(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:   __tcp_cleanup_rbuf(-\u0026gt;) tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160\n[5201\u0026lt;-\u0026gt;39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---(CVE-2025-21710)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/rose: prevent integer overflows in rose_setsockopt()\n\nIn case of possible unpredictably large arguments passed to\nrose_setsockopt() and multiplied by extra values on top of that,\ninteger overflows may occur.\n\nDo the safest minimum and fix these issues by checking the\ncontents of \u0026apos;opt\u0026apos; and returning -EINVAL if they are too large. Also,\nswitch to unsigned int and remove useless check for negative \u0026apos;opt\u0026apos;\nin ROSE_IDLE case.(CVE-2025-21711)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: davicom: fix UAF in dm9000_drv_remove\n\ndm is netdev private data and it cannot be\nused after free_netdev() call. Using dm after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.\n\nThis is similar to the issue fixed in commit\nad297cd2db89 (\u0026quot;net: qcom/emac: fix UAF in emac_remove\u0026quot;).\n\nThis bug is detected by our static analysis tool.(CVE-2025-21715)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix uninit-value in vxlan_vnifilter_dump()\n\nKMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1].\n\nIf the length of the netlink message payload is less than\nsizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes\nbeyond the message. This can lead to uninit-value access. Fix this by\nreturning an error in such situations.\n\n[1]\nBUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422\n vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422\n rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786\n netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317\n __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432\n netlink_dump_start include/linux/netlink.h:340 [inline]\n rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline]\n rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882\n netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542\n rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944\n netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\n netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347\n netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:726\n ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637\n __sys_sendmsg net/socket.c:2669 [inline]\n __do_sys_sendmsg net/socket.c:2674 [inline]\n __se_sys_sendmsg net/socket.c:2672 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672\n x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4110 [inline]\n slab_alloc_node mm/slub.c:4153 [inline]\n kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205\n kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587\n __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678\n alloc_skb include/linux/skbuff.h:1323 [inline]\n netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196\n netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:726\n ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637\n __sys_sendmsg net/socket.c:2669 [inline]\n __do_sys_sendmsg net/socket.c:2674 [inline]\n __se_sys_sendmsg net/socket.c:2672 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672\n x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014(CVE-2025-21716)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: delete intermediate secpath entry in packet offload mode\n\nPackets handled by hardware have added secpath as a way to inform XFRM\ncore code that this path was already handled. That secpath is not needed\nat all after policy is checked and it is removed later in the stack.\n\nHowever, in the case of IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward),\nthat secpath is not removed and packets which already were handled are reentered\nto the driver TX path with xfrm_offload set.\n\nThe following kernel panic is observed in mlx5 in such case:\n\n mlx5_core 0000:04:00.0 enp4s0f0np0: Link up\n mlx5_core 0000:04:00.1 enp4s0f1np1: Link up\n Initializing XFRM netlink socket\n IPsec XFRM device driver\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0010) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0010 [#1] PREEMPT SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc1-alex #3\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n RIP: 0010:0x0\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n RSP: 0018:ffffb87380003800 EFLAGS: 00010206\n RAX: ffff8df004e02600 RBX: ffffb873800038d8 RCX: 00000000ffff98cf\n RDX: ffff8df00733e108 RSI: ffff8df00521fb80 RDI: ffff8df001661f00\n RBP: ffffb87380003850 R08: ffff8df013980000 R09: 0000000000000010\n R10: 0000000000000002 R11: 0000000000000002 R12: ffff8df001661f00\n R13: ffff8df00521fb80 R14: ffff8df00733e108 R15: ffff8df011faf04e\n FS:  0000000000000000(0000) GS:ffff8df46b800000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffffffffffd6 CR3: 0000000106384000 CR4: 0000000000350ef0\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  ? show_regs+0x63/0x70\n  ? __die_body+0x20/0x60\n  ? __die+0x2b/0x40\n  ? page_fault_oops+0x15c/0x550\n  ? do_user_addr_fault+0x3ed/0x870\n  ? exc_page_fault+0x7f/0x190\n  ? asm_exc_page_fault+0x27/0x30\n  mlx5e_ipsec_handle_tx_skb+0xe7/0x2f0 [mlx5_core]\n  mlx5e_xmit+0x58e/0x1980 [mlx5_core]\n  ? __fib_lookup+0x6a/0xb0\n  dev_hard_start_xmit+0x82/0x1d0\n  sch_direct_xmit+0xfe/0x390\n  __dev_queue_xmit+0x6d8/0xee0\n  ? __fib_lookup+0x6a/0xb0\n  ? internal_add_timer+0x48/0x70\n  ? mod_timer+0xe2/0x2b0\n  neigh_resolve_output+0x115/0x1b0\n  __neigh_update+0x26a/0xc50\n  neigh_update+0x14/0x20\n  arp_process+0x2cb/0x8e0\n  ? __napi_build_skb+0x5e/0x70\n  arp_rcv+0x11e/0x1c0\n  ? dev_gro_receive+0x574/0x820\n  __netif_receive_skb_list_core+0x1cf/0x1f0\n  netif_receive_skb_list_internal+0x183/0x2a0\n  napi_complete_done+0x76/0x1c0\n  mlx5e_napi_poll+0x234/0x7a0 [mlx5_core]\n  __napi_poll+0x2d/0x1f0\n  net_rx_action+0x1a6/0x370\n  ? atomic_notifier_call_chain+0x3b/0x50\n  ? irq_int_handler+0x15/0x20 [mlx5_core]\n  handle_softirqs+0xb9/0x2f0\n  ? handle_irq_event+0x44/0x60\n  irq_exit_rcu+0xdb/0x100\n  common_interrupt+0x98/0xc0\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  asm_common_interrupt+0x27/0x40\n RIP: 0010:pv_native_safe_halt+0xb/0x10\n Code: 09 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 22\n 0f 1f 84 00 00 00 00 00 90 eb 07 0f 00 2d 7f e9 36 00 fb\n40 00 83 ff 07 77 21 89 ff ff 24 fd 88 3d a1 bd 0f 21 f8\n RSP: 0018:ffffffffbe603de8 EFLAGS: 00000202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000f92f46680\n RDX: 0000000000000037 RSI: 00000000ffffffff RDI: 00000000000518d4\n RBP: ffffffffbe603df0 R08: 000000cd42e4dffb R09: ffffffffbe603d70\n R10: 0000004d80d62680 R11: 0000000000000001 R12: ffffffffbe60bf40\n R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffbe60aff8\n  ? default_idle+0x9/0x20\n  arch_cpu_idle+0x9/0x10\n  default_idle_call+0x29/0xf0\n  do_idle+0x1f2/0x240\n  cpu_startup_entry+0x2c/0x30\n  rest_init+0xe7/0x100\n  start_kernel+0x76b/0xb90\n  x86_64_start_reservations+0x18/0x30\n  x86_64_start_kernel+0xc0/0x110\n  ? setup_ghcb+0xe/0x130\n  common_startup_64+0x13e/0x141\n  \u0026lt;/TASK\u0026gt;\n Modules linked in: esp4_offload esp4 xfrm_interface\nxfrm6_tunnel tunnel4 tunnel6 xfrm_user xfrm_algo binf\n---truncated---(CVE-2025-21720)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()\n\nResolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()\nwhere shifting the constant \u0026quot;1\u0026quot; (of type int) by bitmap-\u0026gt;mapped.pgshift\n(an unsigned long value) could result in undefined behavior.\n\nThe constant \u0026quot;1\u0026quot; defaults to a 32-bit \u0026quot;int\u0026quot;, and when \u0026quot;pgshift\u0026quot; exceeds\n31 (e.g., pgshift = 63) the shift operation overflows, as the result\ncannot be represented in a 32-bit type.\n\nTo resolve this, the constant is updated to \u0026quot;1UL\u0026quot;, promoting it to an\nunsigned long type to match the operand\u0026apos;s type.(CVE-2025-21724)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix oops due to unset link speed\n\nIt isn\u0026apos;t guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always\nbe set by the server, so the client must handle any values and then\nprevent oopses like below from happening:\n\nOops: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 1323 Comm: cat Not tainted 6.13.0-rc7 #2\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41\n04/01/2014\nRIP: 0010:cifs_debug_data_proc_show+0xa45/0x1460 [cifs] Code: 00 00 48\n89 df e8 3b cd 1b c1 41 f6 44 24 2c 04 0f 84 50 01 00 00 48 89 ef e8\ne7 d0 1b c1 49 8b 44 24 18 31 d2 49 8d 7c 24 28 \u0026lt;48\u0026gt; f7 74 24 18 48 89\nc3 e8 6e cf 1b c1 41 8b 6c 24 28 49 8d 7c 24\nRSP: 0018:ffffc90001817be0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff88811230022c RCX: ffffffffc041bd99\nRDX: 0000000000000000 RSI: 0000000000000567 RDI: ffff888112300228\nRBP: ffff888112300218 R08: fffff52000302f5f R09: ffffed1022fa58ac\nR10: ffff888117d2c566 R11: 00000000fffffffe R12: ffff888112300200\nR13: 000000012a15343f R14: 0000000000000001 R15: ffff888113f2db58\nFS: 00007fe27119e740(0000) GS:ffff888148600000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe2633c5000 CR3: 0000000124da0000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die_body.cold+0x19/0x27\n ? die+0x2e/0x50\n ? do_trap+0x159/0x1b0\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? do_error_trap+0x90/0x130\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? exc_divide_error+0x39/0x50\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? asm_exc_divide_error+0x1a/0x20\n ? cifs_debug_data_proc_show+0xa39/0x1460 [cifs]\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? seq_read_iter+0x42e/0x790\n seq_read_iter+0x19a/0x790\n proc_reg_read_iter+0xbe/0x110\n ? __pfx_proc_reg_read_iter+0x10/0x10\n vfs_read+0x469/0x570\n ? do_user_addr_fault+0x398/0x760\n ? __pfx_vfs_read+0x10/0x10\n ? find_held_lock+0x8a/0xa0\n ? __pfx_lock_release+0x10/0x10\n ksys_read+0xd3/0x170\n ? __pfx_ksys_read+0x10/0x10\n ? __rcu_read_unlock+0x50/0x270\n ? mark_held_locks+0x1a/0x90\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe271288911\nCode: 00 48 8b 15 01 25 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8\n20 ad 01 00 f3 0f 1e fa 80 3d b5 a7 10 00 00 74 13 31 c0 0f 05 \u0026lt;48\u0026gt; 3d\n00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec\nRSP: 002b:00007ffe87c079d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007fe271288911\nRDX: 0000000000040000 RSI: 00007fe2633c6000 RDI: 0000000000000003\nRBP: 00007ffe87c07a00 R08: 0000000000000000 R09: 00007fe2713e6380\nR10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000\nR13: 00007fe2633c6000 R14: 0000000000000003 R15: 0000000000000000\n \u0026lt;/TASK\u0026gt;\n\nFix this by setting cifs_server_iface::speed to a sane value (1Gbps)\nby default when link speed is unset.(CVE-2025-21725)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npadata: avoid UAF for reorder_work\n\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\ncan not avoid potential UAF issue for reorder_work. This issue can\nhappen just as below:\n\ncrypto_request\t\t\tcrypto_request\t\tcrypto_del_alg\npadata_do_serial\n  ...\n  padata_reorder\n    // processes all remaining\n    // requests then breaks\n    while (1) {\n      if (!padata)\n        break;\n      ...\n    }\n\n\t\t\t\tpadata_do_serial\n\t\t\t\t  // new request added\n\t\t\t\t  list_add\n    // sees the new request\n    queue_work(reorder_work)\n\t\t\t\t  padata_reorder\n\t\t\t\t    queue_work_on(squeue-\u0026gt;work)\n...\n\n\t\t\t\t\u0026lt;kworker context\u0026gt;\n\t\t\t\tpadata_serial_worker\n\t\t\t\t// completes new request,\n\t\t\t\t// no more outstanding\n\t\t\t\t// requests\n\n\t\t\t\t\t\t\tcrypto_del_alg\n\t\t\t\t\t\t\t  // free pd\n\n\u0026lt;kworker context\u0026gt;\ninvoke_padata_reorder\n  // UAF of pd\n\nTo avoid UAF for \u0026apos;reorder_work\u0026apos;, get \u0026apos;pd\u0026apos; ref before put \u0026apos;reorder_work\u0026apos;\ninto the \u0026apos;serial_wq\u0026apos; and put \u0026apos;pd\u0026apos; ref until the \u0026apos;serial_wq\u0026apos; finish.(CVE-2025-21726)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npadata: fix UAF in padata_reorder\n\nA bug was found when run ltp test:\n\nBUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0\nRead of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206\n\nCPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+\nWorkqueue: pdecrypt_parallel padata_parallel_worker\nCall Trace:\n\u0026lt;TASK\u0026gt;\ndump_stack_lvl+0x32/0x50\nprint_address_description.constprop.0+0x6b/0x3d0\nprint_report+0xdd/0x2c0\nkasan_report+0xa5/0xd0\npadata_find_next+0x29/0x1a0\npadata_reorder+0x131/0x220\npadata_parallel_worker+0x3d/0xc0\nprocess_one_work+0x2ec/0x5a0\n\nIf \u0026apos;mdelay(10)\u0026apos; is added before calling \u0026apos;padata_find_next\u0026apos; in the\n\u0026apos;padata_reorder\u0026apos; function, this issue could be reproduced easily with\nltp test (pcrypt_aead01).\n\nThis can be explained as bellow:\n\npcrypt_aead_encrypt\n...\npadata_do_parallel\nrefcount_inc(\u0026amp;pd-\u0026gt;refcnt); // add refcnt\n...\npadata_do_serial\npadata_reorder // pd\nwhile (1) {\npadata_find_next(pd, true); // using pd\nqueue_work_on\n...\npadata_serial_worker\t\t\t\tcrypto_del_alg\npadata_put_pd_cnt // sub refcnt\n\t\t\t\t\t\tpadata_free_shell\n\t\t\t\t\t\tpadata_put_pd(ps-\u0026gt;pd);\n\t\t\t\t\t\t// pd is freed\n// loop again, but pd is freed\n// call padata_find_next, UAF\n}\n\nIn the padata_reorder function, when it loops in \u0026apos;while\u0026apos;, if the alg is\ndeleted, the refcnt may be decreased to 0 before entering\n\u0026apos;padata_find_next\u0026apos;, which leads to UAF.\n\nAs mentioned in [1], do_serial is supposed to be called with BHs disabled\nand always happen under RCU protection, to address this issue, add\nsynchronize_rcu() in \u0026apos;padata_free_shell\u0026apos; wait for all _do_serial calls\nto finish.\n\n[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/\n[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/(CVE-2025-21727)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Send signals asynchronously if !preemptible\n\nBPF programs can execute in all kinds of contexts and when a program\nrunning in a non-preemptible context uses the bpf_send_signal() kfunc,\nit will cause issues because this kfunc can sleep.\nChange `irqs_disabled()` to `!preemptible()`.(CVE-2025-21728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix class @block_class\u0026apos;s subsystem refcount leakage\n\nblkcg_fill_root_iostats() iterates over @block_class\u0026apos;s devices by\nclass_dev_iter_(init|next)(), but does not end iterating with\nclass_dev_iter_exit(), so causes the class\u0026apos;s subsystem refcount leakage.\n\nFix by ending the iterating with class_dev_iter_exit().(CVE-2025-21745)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()\n\nWhen getting the IRQ we use k3_udma_glue_tx_get_irq() which returns\nnegative error value on error. So not NULL check is not sufficient\nto deteremine if IRQ is valid. Check that IRQ is greater then zero\nto ensure it is valid.\n\nThere is no issue at probe time but at runtime user can invoke\n.set_channels which results in the following call chain.\nam65_cpsw_set_channels()\n am65_cpsw_nuss_update_tx_rx_chns()\n  am65_cpsw_nuss_remove_tx_chns()\n  am65_cpsw_nuss_init_tx_chns()\n\nAt this point if am65_cpsw_nuss_init_tx_chns() fails due to\nk3_udma_glue_tx_get_irq() then tx_chn-\u0026gt;irq will be set to a\nnegative value.\n\nThen, at subsequent .set_channels with higher channel count we\nwill attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns()\nleading to a kernel warning.\n\nThe issue is present in the original commit that introduced this driver,\nalthough there, am65_cpsw_nuss_update_tx_rx_chns() existed as\nam65_cpsw_nuss_update_tx_chns().(CVE-2025-21799)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix warnings during S3 suspend\n\nThe enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(),\nand the later one may call the preempt_schedule_common() function,\nresulting in a thread switch and causing the CPU to be in an interrupt\nenabled state after the enable_gpe_wakeup() function returns, leading\nto the warnings as follow.\n\n[ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8\n[ C0]          ...\n[ C0] Call Trace:\n[ C0] [\u0026lt;90000000002243b4\u0026gt;] show_stack+0x64/0x188\n[ C0] [\u0026lt;900000000164673c\u0026gt;] dump_stack_lvl+0x60/0x88\n[ C0] [\u0026lt;90000000002687e4\u0026gt;] __warn+0x8c/0x148\n[ C0] [\u0026lt;90000000015e9978\u0026gt;] report_bug+0x1c0/0x2b0\n[ C0] [\u0026lt;90000000016478e4\u0026gt;] do_bp+0x204/0x3b8\n[ C0] [\u0026lt;90000000025b1924\u0026gt;] exception_handlers+0x1924/0x10000\n[ C0] [\u0026lt;9000000000343bbc\u0026gt;] ktime_get+0xbc/0xc8\n[ C0] [\u0026lt;9000000000354c08\u0026gt;] tick_sched_timer+0x30/0xb0\n[ C0] [\u0026lt;90000000003408e0\u0026gt;] __hrtimer_run_queues+0x160/0x378\n[ C0] [\u0026lt;9000000000341f14\u0026gt;] hrtimer_interrupt+0x144/0x388\n[ C0] [\u0026lt;9000000000228348\u0026gt;] constant_timer_interrupt+0x38/0x48\n[ C0] [\u0026lt;90000000002feba4\u0026gt;] __handle_irq_event_percpu+0x64/0x1e8\n[ C0] [\u0026lt;90000000002fed48\u0026gt;] handle_irq_event_percpu+0x20/0x80\n[ C0] [\u0026lt;9000000000306b9c\u0026gt;] handle_percpu_irq+0x5c/0x98\n[ C0] [\u0026lt;90000000002fd4a0\u0026gt;] generic_handle_domain_irq+0x30/0x48\n[ C0] [\u0026lt;9000000000d0c7b0\u0026gt;] handle_cpu_irq+0x70/0xa8\n[ C0] [\u0026lt;9000000001646b30\u0026gt;] handle_loongarch_irq+0x30/0x48\n[ C0] [\u0026lt;9000000001646bc8\u0026gt;] do_vint+0x80/0xe0\n[ C0] [\u0026lt;90000000002aea1c\u0026gt;] finish_task_switch.isra.0+0x8c/0x2a8\n[ C0] [\u0026lt;900000000164e34c\u0026gt;] __schedule+0x314/0xa48\n[ C0] [\u0026lt;900000000164ead8\u0026gt;] schedule+0x58/0xf0\n[ C0] [\u0026lt;9000000000294a2c\u0026gt;] worker_thread+0x224/0x498\n[ C0] [\u0026lt;900000000029d2f0\u0026gt;] kthread+0xf8/0x108\n[ C0] [\u0026lt;9000000000221f28\u0026gt;] ret_from_kernel_thread+0xc/0xa4\n[ C0]\n[ C0] ---[ end trace 0000000000000000 ]---\n\nThe root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect\nacpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause\na thread switch. Since there is no longer concurrent execution during\nloongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes()\ndirectly in enable_gpe_wakeup().\n\nThe solution is similar to commit 22db06337f590d01 (\u0026quot;ACPI: sleep: Avoid\nbreaking S3 wakeup due to might_sleep()\u0026quot;).(CVE-2025-21803)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()\n\nThe rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region()\nmacro to request a needed resource. A string variable that lives on the\nstack is then used to store a dynamically computed resource name, which\nis then passed on as one of the macro arguments. This can lead to\nundefined behavior.\n\nDepending on the current contents of the memory, the manifestations of\nerrors may vary. One possible output may be as follows:\n\n  $ cat /proc/iomem\n  30000000-37ffffff :\n  38000000-3fffffff :\n\nSometimes, garbage may appear after the colon.\n\nIn very rare cases, if no NULL-terminator is found in memory, the system\nmight crash because the string iterator will overrun which can lead to\naccess of unmapped memory above the stack.\n\nThus, fix this by replacing outbound_name with the name of the previously\nrequested resource. With the changes applied, the output will be as\nfollows:\n\n  $ cat /proc/iomem\n  30000000-37ffffff : memory2\n  38000000-3fffffff : memory3\n\n[kwilczynski: commit log](CVE-2025-21804)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: let net.core.dev_weight always be non-zero\n\nThe following problem was encountered during stability test:\n\n(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \\\n\treturned 1, exceeding its budget of 0.\n------------[ cut here ]------------\nlist_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \\\n\tnext=ffff88905f746e40.\nWARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \\\n\t__list_add_valid_or_report+0xf3/0x130\nCPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+\nRIP: 0010:__list_add_valid_or_report+0xf3/0x130\nCall Trace:\n? __warn+0xcd/0x250\n? __list_add_valid_or_report+0xf3/0x130\nenqueue_to_backlog+0x923/0x1070\nnetif_rx_internal+0x92/0x2b0\n__netif_rx+0x15/0x170\nloopback_xmit+0x2ef/0x450\ndev_hard_start_xmit+0x103/0x490\n__dev_queue_xmit+0xeac/0x1950\nip_finish_output2+0x6cc/0x1620\nip_output+0x161/0x270\nip_push_pending_frames+0x155/0x1a0\nraw_sendmsg+0xe13/0x1550\n__sys_sendto+0x3bf/0x4e0\n__x64_sys_sendto+0xdc/0x1b0\ndo_syscall_64+0x5b/0x170\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe reproduction command is as follows:\n  sysctl -w net.core.dev_weight=0\n  ping 127.0.0.1\n\nThis is because when the napi\u0026apos;s weight is set to 0, process_backlog() may\nreturn 0 and clear the NAPI_STATE_SCHED bit of napi-\u0026gt;state, causing this\nnapi to be re-polled in net_rx_action() until __do_softirq() times out.\nSince the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can\nbe retriggered in enqueue_to_backlog(), causing this issue.\n\nMaking the napi\u0026apos;s weight always non-zero solves this problem.\n\nTriggering this issue requires system-wide admin (setting is\nnot namespaced).(CVE-2025-21806)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can\u0026apos;t work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode.(CVE-2025-21808)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: class: Fix wild pointer dereferences in API class_dev_iter_next()\n\nThere are a potential wild pointer dereferences issue regarding APIs\nclass_dev_iter_(init|next|exit)(), as explained by below typical usage:\n\n// All members of @iter are wild pointers.\nstruct class_dev_iter iter;\n\n// class_dev_iter_init(@iter, @class, ...) checks parameter @class for\n// potential class_to_subsys() error, and it returns void type and does\n// not initialize its output parameter @iter, so caller can not detect\n// the error and continues to invoke class_dev_iter_next(@iter) even if\n// @iter still contains wild pointers.\nclass_dev_iter_init(\u0026amp;iter, ...);\n\n// Dereference these wild pointers in @iter here once suffer the error.\nwhile (dev = class_dev_iter_next(\u0026amp;iter)) { ... };\n\n// Also dereference these wild pointers here.\nclass_dev_iter_exit(\u0026amp;iter);\n\nActually, all callers of these APIs have such usage pattern in kernel tree.\nFix by:\n- Initialize output parameter @iter by memset() in class_dev_iter_init()\n  and give callers prompt by pr_crit() for the error.\n- Check if @iter is valid in class_dev_iter_next().(CVE-2025-21810)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: protect access to buffers with no active references\n\nnilfs_lookup_dirty_data_buffers(), which iterates through the buffers\nattached to dirty data folios/pages, accesses the attached buffers without\nlocking the folios/pages.\n\nFor data cache, nilfs_clear_folio_dirty() may be called asynchronously\nwhen the file system degenerates to read only, so\nnilfs_lookup_dirty_data_buffers() still has the potential to cause use\nafter free issues when buffers lose the protection of their dirty state\nmidway due to this asynchronous clearing and are unintentionally freed by\ntry_to_free_buffers().\n\nEliminate this race issue by adjusting the lock section in this function.(CVE-2025-21811)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nax25: rcu protect dev-\u0026gt;ax25_ptr\n\nsyzbot found a lockdep issue [1].\n\nWe should remove ax25 RTNL dependency in ax25_setsockopt()\n\nThis should also fix a variety of possible UAF in ax25.\n\n[1]\n\nWARNING: possible circular locking dependency detected\n6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted\n------------------------------------------------------\nsyz.5.1818/12806 is trying to acquire lock:\n ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n\nbut task is already holding lock:\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #1 (sk_lock-AF_AX25){+.+.}-{0:0}:\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n        lock_sock_nested+0x48/0x100 net/core/sock.c:3642\n        lock_sock include/net/sock.h:1618 [inline]\n        ax25_kill_by_device net/ax25/af_ax25.c:101 [inline]\n        ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146\n        notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85\n       __dev_notify_flags+0x207/0x400\n        dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026\n        dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563\n        dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820\n        sock_do_ioctl+0x240/0x460 net/socket.c:1234\n        sock_ioctl+0x626/0x8e0 net/socket.c:1339\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:906 [inline]\n        __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-\u0026gt; #0 (rtnl_mutex){+.+.}-{4:4}:\n        check_prev_add kernel/locking/lockdep.c:3161 [inline]\n        check_prevs_add kernel/locking/lockdep.c:3280 [inline]\n        validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904\n        __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n        __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n        __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735\n        ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n        do_sock_setsockopt+0x3af/0x720 net/socket.c:2324\n        __sys_setsockopt net/socket.c:2349 [inline]\n        __do_sys_setsockopt net/socket.c:2355 [inline]\n        __se_sys_setsockopt net/socket.c:2352 [inline]\n        __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nother info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(sk_lock-AF_AX25);\n                               lock(rtnl_mutex);\n                               lock(sk_lock-AF_AX25);\n  lock(rtnl_mutex);\n\n *** DEADLOCK ***\n\n1 lock held by syz.5.1818/12806:\n  #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n  #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074\n  check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206\n  check_prev_add kernel/locking/lockdep.c:3161 [inline]\n  check_prevs_add kernel/lockin\n---truncated---(CVE-2025-21812)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0026apos;t flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this.(CVE-2025-21828)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: avoid holding freeze_mutex during mmap operation\n\nWe use map-\u0026gt;freeze_mutex to prevent races between map_freeze() and\nmemory mapping BPF map contents with writable permissions. The way we\nnaively do this means we\u0026apos;ll hold freeze_mutex for entire duration of all\nthe mm and VMA manipulations, which is completely unnecessary. This can\npotentially also lead to deadlocks, as reported by syzbot in [0].\n\nSo, instead, hold freeze_mutex only during writeability checks, bump\n(proactively) \u0026quot;write active\u0026quot; count for the map, unlock the mutex and\nproceed with mmap logic. And only if something went wrong during mmap\nlogic, then undo that \u0026quot;write active\u0026quot; counter increment.\n\n  [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/(CVE-2025-21853)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:18:45.872181222Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1340","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free of kernel socket in cleanup_bearer().\n\nsyzkaller reported a use-after-free of UDP kernel socket\nin cleanup_bearer() without repro. [0][1]\n\nWhen bearer_disable() calls tipc_udp_disable(), cleanup\nof the UDP kernel socket is deferred by work calling\ncleanup_bearer().\n\ntipc_exit_net() waits for such works to finish by checking\ntipc_net(net)-\u0026gt;wq_count.  However, the work decrements the\ncount too early before releasing the kernel socket,\nunblocking cleanup_net() and resulting in use-after-free.\n\nLet\u0026apos;s move the decrement after releasing the socket in\ncleanup_bearer().\n\n[0]:\nref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at\n     sk_alloc+0x438/0x608\n     inet_create+0x4c8/0xcb0\n     __sock_create+0x350/0x6b8\n     sock_create_kern+0x58/0x78\n     udp_sock_create4+0x68/0x398\n     udp_sock_create+0x88/0xc8\n     tipc_udp_enable+0x5e8/0x848\n     __tipc_nl_bearer_enable+0x84c/0xed8\n     tipc_nl_bearer_enable+0x38/0x60\n     genl_family_rcv_msg_doit+0x170/0x248\n     genl_rcv_msg+0x400/0x5b0\n     netlink_rcv_skb+0x1dc/0x398\n     genl_rcv+0x44/0x68\n     netlink_unicast+0x678/0x8b0\n     netlink_sendmsg+0x5e4/0x898\n     ____sys_sendmsg+0x500/0x830\n\n[1]:\nBUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline]\nBUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979\n udp_hashslot include/net/udp.h:85 [inline]\n udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979\n sk_common_release+0xaf/0x3f0 net/core/sock.c:3820\n inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437\n inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489\n __sock_release net/socket.c:658 [inline]\n sock_release+0xa0/0x210 net/socket.c:686\n cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310\n worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391\n kthread+0x531/0x6b0 kernel/kthread.c:389\n ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244\n\nUninit was created at:\n slab_free_hook mm/slub.c:2269 [inline]\n slab_free mm/slub.c:4580 [inline]\n kmem_cache_free+0x207/0xc40 mm/slub.c:4682\n net_free net/core/net_namespace.c:454 [inline]\n cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310\n worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391\n kthread+0x531/0x6b0 kernel/kthread.c:389\n ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244\n\nCPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: events cleanup_bearer(CVE-2024-56642)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: avoid potential out-of-bound access in fill_frame_info()\n\nsyzbot is able to feed a packet with 14 bytes, pretending\nit is a vlan one.\n\nSince fill_frame_info() is relying on skb-\u0026gt;mac_len already,\nextend the check to cover this case.\n\nBUG: KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:709 [inline]\n BUG: KMSAN: uninit-value in hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724\n  fill_frame_info net/hsr/hsr_forward.c:709 [inline]\n  hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724\n  hsr_dev_xmit+0x2f0/0x350 net/hsr/hsr_device.c:235\n  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n  xmit_one net/core/dev.c:3590 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3606\n  __dev_queue_xmit+0x366a/0x57d0 net/core/dev.c:4434\n  dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3146 [inline]\n  packet_sendmsg+0x91ae/0xa6f0 net/packet/af_packet.c:3178\n  sock_sendmsg_nosec net/socket.c:711 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:726\n  __sys_sendto+0x594/0x750 net/socket.c:2197\n  __do_sys_sendto net/socket.c:2204 [inline]\n  __se_sys_sendto net/socket.c:2200 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200\n  x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4091 [inline]\n  slab_alloc_node mm/slub.c:4134 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1323 [inline]\n  alloc_skb_with_frags+0xc8/0xd00 net/core/skbuff.c:6612\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2881\n  packet_alloc_skb net/packet/af_packet.c:2995 [inline]\n  packet_snd net/packet/af_packet.c:3089 [inline]\n  packet_sendmsg+0x74c6/0xa6f0 net/packet/af_packet.c:3178\n  sock_sendmsg_nosec net/socket.c:711 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:726\n  __sys_sendto+0x594/0x750 net/socket.c:2197\n  __do_sys_sendto net/socket.c:2204 [inline]\n  __se_sys_sendto net/socket.c:2200 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200\n  x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-56648)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer\n\nConsidering that in some extreme cases,\nwhen u_serial driver is accessed by multiple threads,\nThread A is executing the open operation and calling the gs_open,\nThread B is executing the disconnect operation and calling the\ngserial_disconnect function,The port-\u0026gt;port_usb pointer will be set to NULL.\n\nE.g.\n    Thread A                                 Thread B\n    gs_open()                                gadget_unbind_driver()\n    gs_start_io()                            composite_disconnect()\n    gs_start_rx()                            gserial_disconnect()\n    ...                                      ...\n    spin_unlock(\u0026amp;port-\u0026gt;port_lock)\n    status = usb_ep_queue()                  spin_lock(\u0026amp;port-\u0026gt;port_lock)\n    spin_lock(\u0026amp;port-\u0026gt;port_lock)              port-\u0026gt;port_usb = NULL\n    gs_free_requests(port-\u0026gt;port_usb-\u0026gt;in)     spin_unlock(\u0026amp;port-\u0026gt;port_lock)\n    Crash\n\nThis causes thread A to access a null pointer (port-\u0026gt;port_usb is null)\nwhen calling the gs_free_requests function, causing a crash.\n\nIf port_usb is NULL, the release request will be skipped as it\nwill be done by gserial_disconnect.\n\nSo add a null pointer check to gs_start_io before attempting\nto access the value of the pointer port-\u0026gt;port_usb.\n\nCall trace:\n gs_start_io+0x164/0x25c\n gs_open+0x108/0x13c\n tty_open+0x314/0x638\n chrdev_open+0x1b8/0x258\n do_dentry_open+0x2c4/0x700\n vfs_open+0x2c/0x3c\n path_openat+0xa64/0xc60\n do_filp_open+0xb8/0x164\n do_sys_openat2+0x84/0xf0\n __arm64_sys_openat+0x70/0x9c\n invoke_syscall+0x58/0x114\n el0_svc_common+0x80/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x38/0x68(CVE-2024-56670)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrdma/cxgb4: Prevent potential integer overflow on 32bit\n\nThe \u0026quot;gl-\u0026gt;tot_len\u0026quot; variable is controlled by the user.  It comes from\nprocess_responses().  On 32bit systems, the \u0026quot;gl-\u0026gt;tot_len + sizeof(struct\ncpl_pass_accept_req) + sizeof(struct rss_header)\u0026quot; addition could have an\ninteger wrapping bug.  Use size_add() to prevent this.(CVE-2024-57973)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imx-jpeg: Fix potential error pointer dereference in detach_pm()\n\nThe proble is on the first line:\n\n\tif (jpeg-\u0026gt;pd_dev[i] \u0026amp;\u0026amp; !pm_runtime_suspended(jpeg-\u0026gt;pd_dev[i]))\n\nIf jpeg-\u0026gt;pd_dev[i] is an error pointer, then passing it to\npm_runtime_suspended() will lead to an Oops.  The other conditions\ncheck for both error pointers and NULL, but it would be more clear to\nuse the IS_ERR_OR_NULL() check for that.(CVE-2024-57978)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix assumption that Resolution Multipliers must be in Logical Collections\n\nA report in 2019 by the syzbot fuzzer was found to be connected to two\nerrors in the HID core associated with Resolution Multipliers.  One of\nthe errors was fixed by commit ea427a222d8b (\u0026quot;HID: core: Fix deadloop\nin hid_apply_multiplier.\u0026quot;), but the other has not been fixed.\n\nThis error arises because hid_apply_multipler() assumes that every\nResolution Multiplier control is contained in a Logical Collection,\ni.e., there\u0026apos;s no way the routine can ever set multiplier_collection to\nNULL.  This is in spite of the fact that the function starts with a\nbig comment saying:\n\n\t * \u0026quot;The Resolution Multiplier control must be contained in the same\n\t * Logical Collection as the control(s) to which it is to be applied.\n\t   ...\n\t *  If no Logical Collection is\n\t * defined, the Resolution Multiplier is associated with all\n\t * controls in the report.\u0026quot;\n\t * HID Usage Table, v1.12, Section 4.3.1, p30\n\t *\n\t * Thus, search from the current collection upwards until we find a\n\t * logical collection...\n\nThe comment and the code overlook the possibility that none of the\ncollections found may be a Logical Collection.\n\nThe fix is to set the multiplier_collection pointer to NULL if the\ncollection found isn\u0026apos;t a Logical Collection.(CVE-2024-57986)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check\n\nsyzbot has found a type mismatch between a USB pipe and the transfer\nendpoint, which is triggered by the hid-thrustmaster driver[1].\nThere is a number of similar, already fixed issues [2].\nIn this case as in others, implementing check for endpoint type fixes the issue.\n\n[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470\n[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622(CVE-2024-57993)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: fix channel survey memory allocation size\n\nKASAN reported a memory allocation issue in wcn-\u0026gt;chan_survey\ndue to incorrect size calculation.\nThis commit uses kcalloc to allocate memory for wcn-\u0026gt;chan_survey,\nensuring proper initialization and preventing the use of uninitialized\nvalues when there are no frames on the channel.(CVE-2024-57997)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nOPP: add index check to assert to avoid buffer overflow in _read_freq()\n\nPass the freq index to the assert function to make sure\nwe do not read a freq out of the opp-\u0026gt;rates[] table when called\nfrom the indexed variants:\ndev_pm_opp_find_freq_exact_indexed() or\ndev_pm_opp_find_freq_ceil/floor_indexed().\n\nAdd a secondary parameter to the assert function, unused\nfor assert_single_clk() then add assert_clk_index() which\nwill check for the clock index when called from the _indexed()\nfind functions.(CVE-2024-57998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()\n\nIn commit 4284c88fff0e (\u0026quot;PCI: designware-ep: Allow pci_epc_set_bar() update\ninbound map address\u0026quot;) set_bar() was modified to support dynamically\nchanging the backing physical address of a BAR that was already configured.\n\nThis means that set_bar() can be called twice, without ever calling\nclear_bar() (as calling clear_bar() would clear the BAR\u0026apos;s PCI address\nassigned by the host).\n\nThis can only be done if the new BAR size/flags does not differ from the\nexisting BAR configuration. Add these missing checks.\n\nIf we allow set_bar() to set e.g. a new BAR size that differs from the\nexisting BAR size, the new address translation range will be smaller than\nthe BAR size already determined by the host, which would mean that a read\npast the new BAR size would pass the iATU untranslated, which could allow\nthe host to read memory not belonging to the new struct pci_epf_bar.\n\nWhile at it, add comments which clarifies the support for dynamically\nchanging the physical address of a BAR. (Which was also missing.)(CVE-2024-58006)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()\n\nAs of_find_node_by_name() release the reference of the argument device\nnode, tegra_emc_find_node_by_ram_code() releases some device nodes while\nstill in use, resulting in possible UAFs. According to the bindings and\nthe in-tree DTS files, the \u0026quot;emc-tables\u0026quot; node is always device\u0026apos;s child\nnode with the property \u0026quot;nvidia,use-ram-code\u0026quot;, and the \u0026quot;lpddr2\u0026quot; node is a\nchild of the \u0026quot;emc-tables\u0026quot; node. Thus utilize the\nfor_each_child_of_node() macro and of_get_child_by_name() instead of\nof_find_node_by_name() to simplify the code.\n\nThis bug was found by an experimental verification tool that I am\ndeveloping.\n\n[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts](CVE-2024-58034)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: Add check devm_kasprintf() returned value\n\ndevm_kasprintf() can return a NULL pointer on failure but this\nreturned value is not checked.(CVE-2024-58051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table\n\nThe function atomctrl_get_smc_sclk_range_table() does not check the return\nvalue of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to\nretrieve SMU_Info table, it returns NULL which is later dereferenced.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nIn practice this should never happen as this code only gets called\non polaris chips and the vbios data table will always be present on\nthose chips.(CVE-2024-58052)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we\u0026apos;ve received.  Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection.  Whilst the propagation bit is performed, the calls aren\u0026apos;t then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts.(CVE-2024-58053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: max96712: fix kernel oops when removing module\n\nThe following kernel oops is thrown when trying to remove the max96712\nmodule:\n\nUnable to handle kernel paging request at virtual address 00007375746174db\nMem abort info:\n  ESR = 0x0000000096000004\n  EC = 0x25: DABT (current EL), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x04: level 0 translation fault\nData abort info:\n  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n  CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=000000010af89000\n[00007375746174db] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] PREEMPT SMP\nModules linked in: crct10dif_ce polyval_ce mxc_jpeg_encdec flexcan\n    snd_soc_fsl_sai snd_soc_fsl_asoc_card snd_soc_fsl_micfil dwc_mipi_csi2\n    imx_csi_formatter polyval_generic v4l2_jpeg imx_pcm_dma can_dev\n    snd_soc_imx_audmux snd_soc_wm8962 snd_soc_imx_card snd_soc_fsl_utils\n    max96712(C-) rpmsg_ctrl rpmsg_char pwm_fan fuse\n    [last unloaded: imx8_isi]\nCPU: 0 UID: 0 PID: 754 Comm: rmmod\n\t    Tainted: G         C    6.12.0-rc6-06364-g327fec852c31 #17\nTainted: [C]=CRAP\nHardware name: NXP i.MX95 19X19 board (DT)\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : led_put+0x1c/0x40\nlr : v4l2_subdev_put_privacy_led+0x48/0x58\nsp : ffff80008699bbb0\nx29: ffff80008699bbb0 x28: ffff00008ac233c0 x27: 0000000000000000\nx26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff000080cf1170 x22: ffff00008b53bd00 x21: ffff8000822ad1c8\nx20: ffff000080ff5c00 x19: ffff00008b53be40 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000004 x13: ffff0000800f8010 x12: 0000000000000000\nx11: ffff000082acf5c0 x10: ffff000082acf478 x9 : ffff0000800f8010\nx8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d\nx5 : 8080808000000000 x4 : 0000000000000020 x3 : 00000000553a3dc1\nx2 : ffff00008ac233c0 x1 : ffff00008ac233c0 x0 : ff00737574617473\nCall trace:\n led_put+0x1c/0x40\n v4l2_subdev_put_privacy_led+0x48/0x58\n v4l2_async_unregister_subdev+0x2c/0x1a4\n max96712_remove+0x1c/0x38 [max96712]\n i2c_device_remove+0x2c/0x9c\n device_remove+0x4c/0x80\n device_release_driver_internal+0x1cc/0x228\n driver_detach+0x4c/0x98\n bus_remove_driver+0x6c/0xbc\n driver_unregister+0x30/0x60\n i2c_del_driver+0x54/0x64\n max96712_i2c_driver_exit+0x18/0x1d0 [max96712]\n __arm64_sys_delete_module+0x1a4/0x290\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x34/0xd8\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x190/0x194\nCode: f9000bf3 aa0003f3 f9402800 f9402000 (f9403400)\n---[ end trace 0000000000000000 ]---\n\nThis happens because in v4l2_i2c_subdev_init(), the i2c_set_cliendata()\nis called again and the data is overwritten to point to sd, instead of\npriv. So, in remove(), the wrong pointer is passed to\nv4l2_async_unregister_subdev(), leading to a crash.(CVE-2024-58054)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: core: Fix ida_free call while not allocated\n\nIn the rproc_alloc() function, on error, put_device(\u0026amp;rproc-\u0026gt;dev) is\ncalled, leading to the call of the rproc_type_release() function.\nAn error can occurs before ida_alloc is called.\n\nIn such case in rproc_type_release(), the condition (rproc-\u0026gt;index \u0026gt;= 0) is\ntrue as rproc-\u0026gt;index has been  initialized to 0.\nida_free() is called reporting a warning:\n[    4.181906] WARNING: CPU: 1 PID: 24 at lib/idr.c:525 ida_free+0x100/0x164\n[    4.186378] stm32-display-dsi 5a000000.dsi: Fixed dependency cycle(s) with /soc/dsi@5a000000/panel@0\n[    4.188854] ida_free called for id=0 which is not allocated.\n[    4.198256] mipi-dsi 5a000000.dsi.0: Fixed dependency cycle(s) with /soc/dsi@5a000000\n[    4.203556] Modules linked in: panel_orisetech_otm8009a dw_mipi_dsi_stm(+) gpu_sched dw_mipi_dsi stm32_rproc stm32_crc32 stm32_ipcc(+) optee(+)\n[    4.224307] CPU: 1 UID: 0 PID: 24 Comm: kworker/u10:0 Not tainted 6.12.0 #442\n[    4.231481] Hardware name: STM32 (Device Tree Support)\n[    4.236627] Workqueue: events_unbound deferred_probe_work_func\n[    4.242504] Call trace:\n[    4.242522]  unwind_backtrace from show_stack+0x10/0x14\n[    4.250218]  show_stack from dump_stack_lvl+0x50/0x64\n[    4.255274]  dump_stack_lvl from __warn+0x80/0x12c\n[    4.260134]  __warn from warn_slowpath_fmt+0x114/0x188\n[    4.265199]  warn_slowpath_fmt from ida_free+0x100/0x164\n[    4.270565]  ida_free from rproc_type_release+0x38/0x60\n[    4.275832]  rproc_type_release from device_release+0x30/0xa0\n[    4.281601]  device_release from kobject_put+0xc4/0x294\n[    4.286762]  kobject_put from rproc_alloc.part.0+0x208/0x28c\n[    4.292430]  rproc_alloc.part.0 from devm_rproc_alloc+0x80/0xc4\n[    4.298393]  devm_rproc_alloc from stm32_rproc_probe+0xd0/0x844 [stm32_rproc]\n[    4.305575]  stm32_rproc_probe [stm32_rproc] from platform_probe+0x5c/0xbc\n\nCalling ida_alloc earlier in rproc_alloc ensures that the rproc-\u0026gt;index is\nproperly set.(CVE-2024-58056)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nubifs: skip dumping tnc tree when zroot is null\n\nClearing slab cache will free all znode in memory and make\nc-\u0026gt;zroot.znode = NULL, then dumping tnc tree will access\nc-\u0026gt;zroot.znode which cause null pointer dereference.(CVE-2024-58058)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: prohibit deactivating all links\n\nIn the internal API this calls this is a WARN_ON, but that\nshould remain since internally we want to know about bugs\nthat may cause this. Prevent deactivating all links in the\ndebugfs write directly.(CVE-2024-58061)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: fix memory leaks and invalid access at probe error path\n\nDeinitialize at reverse order when probe fails.\n\nWhen init_sw_vars fails, rtl_deinit_core should not be called, specially\nnow that it destroys the rtl_wq workqueue.\n\nAnd call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be\nleaked.\n\nRemove pci_set_drvdata call as it will already be cleaned up by the core\ndriver code and could lead to memory leaks too. cf. commit 8d450935ae7f\n(\u0026quot;wireless: rtlwifi: remove unnecessary pci_set_drvdata()\u0026quot;) and\ncommit 3d86b93064c7 (\u0026quot;rtlwifi: Fix PCI probe error path orphaned memory\u0026quot;).(CVE-2024-58063)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nOPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized\n\nIf a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth\nfrom the OPP table but the bandwidth table was not created because the\ninterconnect properties were missing in the OPP consumer node, the\nkernel will crash with:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n...\npc : _read_bw+0x8/0x10\nlr : _opp_table_find_key+0x9c/0x174\n...\nCall trace:\n  _read_bw+0x8/0x10 (P)\n  _opp_table_find_key+0x9c/0x174 (L)\n  _find_key+0x98/0x168\n  dev_pm_opp_find_bw_ceil+0x50/0x88\n...\n\nIn order to fix the crash, create an assert function to check\nif the bandwidth table was created before trying to get a\nbandwidth with _read_bw().(CVE-2024-58068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: prevent adding a device which is already a team device lower\n\nPrevent adding a device which is already a team device lower,\ne.g. adding veth0 if vlan1 was already added and veth0 is a lower of\nvlan1.\n\nThis is not useful in practice and can lead to recursive locking:\n\n$ ip link add veth0 type veth peer name veth1\n$ ip link set veth0 up\n$ ip link set veth1 up\n$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1\n$ ip link add team0 type team\n$ ip link set veth0.1 down\n$ ip link set veth0.1 master team0\nteam0: Port device veth0.1 added\n$ ip link set veth0 down\n$ ip link set veth0 master team0\n\n============================================\nWARNING: possible recursive locking detected\n6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted\n--------------------------------------------\nip/7684 is trying to acquire lock:\nffff888016848e00 (team-\u0026gt;team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n\nbut task is already holding lock:\nffff888016848e00 (team-\u0026gt;team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977)\n\nother info that might help us debug this:\nPossible unsafe locking scenario:\n\nCPU0\n----\nlock(team-\u0026gt;team_lock_key);\nlock(team-\u0026gt;team_lock_key);\n\n*** DEADLOCK ***\n\nMay be due to missing lock nesting notation\n\n2 locks held by ip/7684:\n\nstack backtrace:\nCPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n\u0026lt;TASK\u0026gt;\ndump_stack_lvl (lib/dump_stack.c:122)\nprint_deadlock_bug.cold (kernel/locking/lockdep.c:3040)\n__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226)\n? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548)\nlock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2))\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? lock_acquire (kernel/locking/lockdep.c:5822)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? fib_sync_up (net/ipv4/fib_semantics.c:2167)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\nteam_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\nnotifier_call_chain (kernel/notifier.c:85)\ncall_netdevice_notifiers_info (net/core/dev.c:1996)\n__dev_notify_flags (net/core/dev.c:8993)\n? __dev_change_flags (net/core/dev.c:8975)\ndev_change_flags (net/core/dev.c:9027)\nvlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470)\n? br_device_event (net/bridge/br.c:143)\nnotifier_call_chain (kernel/notifier.c:85)\ncall_netdevice_notifiers_info (net/core/dev.c:1996)\ndev_open (net/core/dev.c:1519 net/core/dev.c:1505)\nteam_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977)\n? __pfx_team_add_slave (drivers/net/team/team_core.c:1972)\ndo_set_master (net/core/rtnetlink.c:2917)\ndo_setlink.isra.0 (net/core/rtnetlink.c:3117)(CVE-2024-58071)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: remove unused check_buddy_priv\n\nCommit 2461c7d60f9f (\u0026quot;rtlwifi: Update header file\u0026quot;) introduced a global\nlist of private data structures.\n\nLater on, commit 26634c4b1868 (\u0026quot;rtlwifi Modify existing bits to match\nvendor version 2013.02.07\u0026quot;) started adding the private data to that list at\nprobe time and added a hook, check_buddy_priv to find the private data from\na similar device.\n\nHowever, that function was never used.\n\nBesides, though there is a lock for that list, it is never used. And when\nthe probe fails, the private data is never removed from the list. This\nwould cause a second probe to access freed memory.\n\nRemove the unused hook, structures and members, which will prevent the\npotential race condition on the list and its corruption during a second\nprobe when probe fails.(CVE-2024-58072)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvfio/platform: check the bounds of read/write syscalls\n\ncount and offset are passed from user space and not checked, only\noffset is capped to 40 bits, which can be used to read/write out of\nbounds of the device.(CVE-2025-21687)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: handle fastopen disconnect correctly\n\nSyzbot was able to trigger a data stream corruption:\n\n  WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 __mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 9846 Comm: syz-executor351 Not tainted 6.13.0-rc2-syzkaller-00059-g00a5acdbf398 #0\n  Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024\n  RIP: 0010:__mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024\n  Code: fa ff ff 48 8b 4c 24 18 80 e1 07 fe c1 38 c1 0f 8c 8e fa ff ff 48 8b 7c 24 18 e8 e0 db 54 f6 e9 7f fa ff ff e8 e6 80 ee f5 90 \u0026lt;0f\u0026gt; 0b 90 4c 8b 6c 24 40 4d 89 f4 e9 04 f5 ff ff 44 89 f1 80 e1 07\n  RSP: 0018:ffffc9000c0cf400 EFLAGS: 00010293\n  RAX: ffffffff8bb0dd5a RBX: ffff888033f5d230 RCX: ffff888059ce8000\n  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n  RBP: ffffc9000c0cf518 R08: ffffffff8bb0d1dd R09: 1ffff110170c8928\n  R10: dffffc0000000000 R11: ffffed10170c8929 R12: 0000000000000000\n  R13: ffff888033f5d220 R14: dffffc0000000000 R15: ffff8880592b8000\n  FS:  00007f6e866496c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f6e86f491a0 CR3: 00000000310e6000 CR4: 00000000003526f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __mptcp_clean_una_wakeup+0x7f/0x2d0 net/mptcp/protocol.c:1074\n   mptcp_release_cb+0x7cb/0xb30 net/mptcp/protocol.c:3493\n   release_sock+0x1aa/0x1f0 net/core/sock.c:3640\n   inet_wait_for_connect net/ipv4/af_inet.c:609 [inline]\n   __inet_stream_connect+0x8bd/0xf30 net/ipv4/af_inet.c:703\n   mptcp_sendmsg_fastopen+0x2a2/0x530 net/mptcp/protocol.c:1755\n   mptcp_sendmsg+0x1884/0x1b10 net/mptcp/protocol.c:1830\n   sock_sendmsg_nosec net/socket.c:711 [inline]\n   __sock_sendmsg+0x1a6/0x270 net/socket.c:726\n   ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\n   ___sys_sendmsg net/socket.c:2637 [inline]\n   __sys_sendmsg+0x269/0x350 net/socket.c:2669\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x7f6e86ebfe69\n  Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n  RSP: 002b:00007f6e86649168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n  RAX: ffffffffffffffda RBX: 00007f6e86f491b8 RCX: 00007f6e86ebfe69\n  RDX: 0000000030004001 RSI: 0000000020000080 RDI: 0000000000000003\n  RBP: 00007f6e86f491b0 R08: 00007f6e866496c0 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6e86f491bc\n  R13: 000000000000006e R14: 00007ffe445d9420 R15: 00007ffe445d9508\n   \u0026lt;/TASK\u0026gt;\n\nThe root cause is the bad handling of disconnect() generated internally\nby the MPTCP protocol in case of connect FASTOPEN errors.\n\nAddress the issue increasing the socket disconnect counter even on such\na case, to allow other threads waiting on the same socket lock to\nproperly error out.(CVE-2025-21705)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: consolidate suboption status\n\nMPTCP maintains the received sub-options status is the bitmask carrying\nthe received suboptions and in several bitfields carrying per suboption\nadditional info.\n\nZeroing the bitmask before parsing is not enough to ensure a consistent\nstatus, and the MPTCP code has to additionally clear some bitfiled\ndepending on the actually parsed suboption.\n\nThe above schema is fragile, and syzbot managed to trigger a path where\na relevant bitfield is not cleared/initialized:\n\n  BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline]\n  BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline]\n  BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline]\n  BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209\n   __mptcp_expand_seq net/mptcp/options.c:1030 [inline]\n   mptcp_expand_seq net/mptcp/protocol.h:864 [inline]\n   ack_update_msk net/mptcp/options.c:1060 [inline]\n   mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209\n   tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233\n   tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264\n   tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916\n   tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351\n   ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205\n   ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233\n   NF_HOOK include/linux/netfilter.h:314 [inline]\n   ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n   dst_input include/net/dst.h:460 [inline]\n   ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447\n   NF_HOOK include/linux/netfilter.h:314 [inline]\n   ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567\n   __netif_receive_skb_one_core net/core/dev.c:5704 [inline]\n   __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817\n   process_backlog+0x4ad/0xa50 net/core/dev.c:6149\n   __napi_poll+0xe7/0x980 net/core/dev.c:6902\n   napi_poll net/core/dev.c:6971 [inline]\n   net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093\n   handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561\n   __do_softirq+0x14/0x1a kernel/softirq.c:595\n   do_softirq+0x9a/0x100 kernel/softirq.c:462\n   __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389\n   local_bh_enable include/linux/bottom_half.h:33 [inline]\n   rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]\n   __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493\n   dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n   neigh_hh_output include/net/neighbour.h:523 [inline]\n   neigh_output include/net/neighbour.h:537 [inline]\n   ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236\n   __ip_finish_output+0x287/0x810\n   ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324\n   NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n   ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434\n   dst_output include/net/dst.h:450 [inline]\n   ip_local_out net/ipv4/ip_output.c:130 [inline]\n   __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536\n   ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550\n   __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468\n   tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline]\n   tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829\n   __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012\n   tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618\n   __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130\n   __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496\n   mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550\n   mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889\n   mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline]\n   mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline]\n   mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline]\n   mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750\n   genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n \n---truncated---(CVE-2025-21707)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: enable basic endpoint checking\n\nSyzkaller reports [1] encountering a common issue of utilizing a wrong\nusb endpoint type during URB submitting stage. This, in turn, triggers\na warning shown below.\n\nFor now, enable simple endpoint checking (specifically, bulk and\ninterrupt eps, testing control one is not essential) to mitigate\nthe issue with a view to do other related cosmetic changes later,\nif they are necessary.\n\n[1] Syzkaller report:\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv\u0026gt;\nModules linked in:\nCPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617\u0026gt;\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\nCode: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8\u0026gt;\nRSP: 0018:ffffc9000441f740 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9\nRDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001\nRBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c\nFS:  00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733\n __dev_open+0x2d4/0x4e0 net/core/dev.c:1474\n __dev_change_flags+0x561/0x720 net/core/dev.c:8838\n dev_change_flags+0x8f/0x160 net/core/dev.c:8910\n devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177\n inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003\n sock_do_ioctl+0x116/0x280 net/socket.c:1222\n sock_ioctl+0x22e/0x6c0 net/socket.c:1341\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl fs/ioctl.c:893 [inline]\n __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fc04ef73d49\n...\n\nThis change has not been tested on real hardware.(CVE-2025-21708)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: correct handling of extreme memory squeeze\n\nTesting with iperf3 using the \u0026quot;pasta\u0026quot; protocol splicer has revealed\na problem in the way tcp handles window advertising in extreme memory\nsqueeze situations.\n\nUnder memory pressure, a socket endpoint may temporarily advertise\na zero-sized window, but this is not stored as part of the socket data.\nThe reasoning behind this is that it is considered a temporary setting\nwhich shouldn\u0026apos;t influence any further calculations.\n\nHowever, if we happen to stall at an unfortunate value of the current\nwindow size, the algorithm selecting a new value will consistently fail\nto advertise a non-zero window once we have freed up enough memory.\nThis means that this side\u0026apos;s notion of the current window size is\ndifferent from the one last advertised to the peer, causing the latter\nto not send any data to resolve the sitution.\n\nThe problem occurs on the iperf3 server side, and the socket in question\nis a completely regular socket with the default settings for the\nfedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.\n\nThe following excerpt of a logging session, with own comments added,\nshows more in detail what is happening:\n\n//              tcp_v4_rcv(-\u0026gt;)\n//                tcp_rcv_established(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ====\n[5201\u0026lt;-\u0026gt;39222]:     tcp_data_queue(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM\n                       [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                       [copied_seq 259909392-\u0026gt;260034360 (124968), unread 5565800, qlen 85, ofoq 0]\n                       [OFO queue: gap: 65480, len: 0]\n[5201\u0026lt;-\u0026gt;39222]:     tcp_data_queue(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]:     __tcp_transmit_skb(-\u0026gt;)\n                        [tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160]\n[5201\u0026lt;-\u0026gt;39222]:       tcp_select_window(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:         (inet_csk(sk)-\u0026gt;icsk_ack.pending \u0026amp; ICSK_ACK_NOMEM) ? --\u0026gt; TRUE\n                        [tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160]\n                        returning 0\n[5201\u0026lt;-\u0026gt;39222]:       tcp_select_window(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160\n[5201\u0026lt;-\u0026gt;39222]:     [__tcp_transmit_skb(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]:   tcp_rcv_established(\u0026lt;-)\n[5201\u0026lt;-\u0026gt;39222]: tcp_v4_rcv(\u0026lt;-)\n\n// Receive queue is at 85 buffers and we are out of memory.\n// We drop the incoming buffer, although it is in sequence, and decide\n// to send an advertisement with a window of zero.\n// We don\u0026apos;t update tp-\u0026gt;rcv_wnd and tp-\u0026gt;rcv_wup accordingly, which means\n// we unconditionally shrink the window.\n\n[5201\u0026lt;-\u0026gt;39222]: tcp_recvmsg_locked(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:   __tcp_cleanup_rbuf(-\u0026gt;) tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160\n[5201\u0026lt;-\u0026gt;39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368]\n[5201\u0026lt;-\u0026gt;39222]:     [new_win \u0026gt;= (2 * win_now) ? --\u0026gt; time_to_ack = 0]\n[5201\u0026lt;-\u0026gt;39222]:     NOT calling tcp_send_ack()\n                    [tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160]\n[5201\u0026lt;-\u0026gt;39222]:   __tcp_cleanup_rbuf(\u0026lt;-)\n                  [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]\n                  [copied_seq 260040464-\u0026gt;260040464 (0), unread 5559696, qlen 85, ofoq 0]\n                  returning 6104 bytes\n[5201\u0026lt;-\u0026gt;39222]: tcp_recvmsg_locked(\u0026lt;-)\n\n// After each read, the algorithm for calculating the new receive\n// window in __tcp_cleanup_rbuf() finds it is too small to advertise\n// or to update tp-\u0026gt;rcv_wnd.\n// Meanwhile, the peer thinks the window is zero, and will not send\n// any more data to trigger an update from the interrupt mode side.\n\n[5201\u0026lt;-\u0026gt;39222]: tcp_recvmsg_locked(-\u0026gt;)\n[5201\u0026lt;-\u0026gt;39222]:   __tcp_cleanup_rbuf(-\u0026gt;) tp-\u0026gt;rcv_wup: 265469200, tp-\u0026gt;rcv_wnd: 262144, tp-\u0026gt;rcv_nxt 265600160\n[5201\u0026lt;-\u0026gt;39222]:     [new_win = 262144, win_now = 131184, 2 * win_n\n---truncated---(CVE-2025-21710)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/rose: prevent integer overflows in rose_setsockopt()\n\nIn case of possible unpredictably large arguments passed to\nrose_setsockopt() and multiplied by extra values on top of that,\ninteger overflows may occur.\n\nDo the safest minimum and fix these issues by checking the\ncontents of \u0026apos;opt\u0026apos; and returning -EINVAL if they are too large. Also,\nswitch to unsigned int and remove useless check for negative \u0026apos;opt\u0026apos;\nin ROSE_IDLE case.(CVE-2025-21711)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: davicom: fix UAF in dm9000_drv_remove\n\ndm is netdev private data and it cannot be\nused after free_netdev() call. Using dm after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.\n\nThis is similar to the issue fixed in commit\nad297cd2db89 (\u0026quot;net: qcom/emac: fix UAF in emac_remove\u0026quot;).\n\nThis bug is detected by our static analysis tool.(CVE-2025-21715)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix uninit-value in vxlan_vnifilter_dump()\n\nKMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1].\n\nIf the length of the netlink message payload is less than\nsizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes\nbeyond the message. This can lead to uninit-value access. Fix this by\nreturning an error in such situations.\n\n[1]\nBUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422\n vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422\n rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786\n netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317\n __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432\n netlink_dump_start include/linux/netlink.h:340 [inline]\n rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline]\n rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882\n netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542\n rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944\n netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\n netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347\n netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:726\n ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637\n __sys_sendmsg net/socket.c:2669 [inline]\n __do_sys_sendmsg net/socket.c:2674 [inline]\n __se_sys_sendmsg net/socket.c:2672 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672\n x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4110 [inline]\n slab_alloc_node mm/slub.c:4153 [inline]\n kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205\n kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587\n __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678\n alloc_skb include/linux/skbuff.h:1323 [inline]\n netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196\n netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:726\n ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637\n __sys_sendmsg net/socket.c:2669 [inline]\n __do_sys_sendmsg net/socket.c:2674 [inline]\n __se_sys_sendmsg net/socket.c:2672 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672\n x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014(CVE-2025-21716)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: delete intermediate secpath entry in packet offload mode\n\nPackets handled by hardware have added secpath as a way to inform XFRM\ncore code that this path was already handled. That secpath is not needed\nat all after policy is checked and it is removed later in the stack.\n\nHowever, in the case of IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward),\nthat secpath is not removed and packets which already were handled are reentered\nto the driver TX path with xfrm_offload set.\n\nThe following kernel panic is observed in mlx5 in such case:\n\n mlx5_core 0000:04:00.0 enp4s0f0np0: Link up\n mlx5_core 0000:04:00.1 enp4s0f1np1: Link up\n Initializing XFRM netlink socket\n IPsec XFRM device driver\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0010) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0010 [#1] PREEMPT SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc1-alex #3\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n RIP: 0010:0x0\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n RSP: 0018:ffffb87380003800 EFLAGS: 00010206\n RAX: ffff8df004e02600 RBX: ffffb873800038d8 RCX: 00000000ffff98cf\n RDX: ffff8df00733e108 RSI: ffff8df00521fb80 RDI: ffff8df001661f00\n RBP: ffffb87380003850 R08: ffff8df013980000 R09: 0000000000000010\n R10: 0000000000000002 R11: 0000000000000002 R12: ffff8df001661f00\n R13: ffff8df00521fb80 R14: ffff8df00733e108 R15: ffff8df011faf04e\n FS:  0000000000000000(0000) GS:ffff8df46b800000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffffffffffd6 CR3: 0000000106384000 CR4: 0000000000350ef0\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  ? show_regs+0x63/0x70\n  ? __die_body+0x20/0x60\n  ? __die+0x2b/0x40\n  ? page_fault_oops+0x15c/0x550\n  ? do_user_addr_fault+0x3ed/0x870\n  ? exc_page_fault+0x7f/0x190\n  ? asm_exc_page_fault+0x27/0x30\n  mlx5e_ipsec_handle_tx_skb+0xe7/0x2f0 [mlx5_core]\n  mlx5e_xmit+0x58e/0x1980 [mlx5_core]\n  ? __fib_lookup+0x6a/0xb0\n  dev_hard_start_xmit+0x82/0x1d0\n  sch_direct_xmit+0xfe/0x390\n  __dev_queue_xmit+0x6d8/0xee0\n  ? __fib_lookup+0x6a/0xb0\n  ? internal_add_timer+0x48/0x70\n  ? mod_timer+0xe2/0x2b0\n  neigh_resolve_output+0x115/0x1b0\n  __neigh_update+0x26a/0xc50\n  neigh_update+0x14/0x20\n  arp_process+0x2cb/0x8e0\n  ? __napi_build_skb+0x5e/0x70\n  arp_rcv+0x11e/0x1c0\n  ? dev_gro_receive+0x574/0x820\n  __netif_receive_skb_list_core+0x1cf/0x1f0\n  netif_receive_skb_list_internal+0x183/0x2a0\n  napi_complete_done+0x76/0x1c0\n  mlx5e_napi_poll+0x234/0x7a0 [mlx5_core]\n  __napi_poll+0x2d/0x1f0\n  net_rx_action+0x1a6/0x370\n  ? atomic_notifier_call_chain+0x3b/0x50\n  ? irq_int_handler+0x15/0x20 [mlx5_core]\n  handle_softirqs+0xb9/0x2f0\n  ? handle_irq_event+0x44/0x60\n  irq_exit_rcu+0xdb/0x100\n  common_interrupt+0x98/0xc0\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  asm_common_interrupt+0x27/0x40\n RIP: 0010:pv_native_safe_halt+0xb/0x10\n Code: 09 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 22\n 0f 1f 84 00 00 00 00 00 90 eb 07 0f 00 2d 7f e9 36 00 fb\n40 00 83 ff 07 77 21 89 ff ff 24 fd 88 3d a1 bd 0f 21 f8\n RSP: 0018:ffffffffbe603de8 EFLAGS: 00000202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000f92f46680\n RDX: 0000000000000037 RSI: 00000000ffffffff RDI: 00000000000518d4\n RBP: ffffffffbe603df0 R08: 000000cd42e4dffb R09: ffffffffbe603d70\n R10: 0000004d80d62680 R11: 0000000000000001 R12: ffffffffbe60bf40\n R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffbe60aff8\n  ? default_idle+0x9/0x20\n  arch_cpu_idle+0x9/0x10\n  default_idle_call+0x29/0xf0\n  do_idle+0x1f2/0x240\n  cpu_startup_entry+0x2c/0x30\n  rest_init+0xe7/0x100\n  start_kernel+0x76b/0xb90\n  x86_64_start_reservations+0x18/0x30\n  x86_64_start_kernel+0xc0/0x110\n  ? setup_ghcb+0xe/0x130\n  common_startup_64+0x13e/0x141\n  \u0026lt;/TASK\u0026gt;\n Modules linked in: esp4_offload esp4 xfrm_interface\nxfrm6_tunnel tunnel4 tunnel6 xfrm_user xfrm_algo binf\n---truncated---(CVE-2025-21720)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()\n\nResolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()\nwhere shifting the constant \u0026quot;1\u0026quot; (of type int) by bitmap-\u0026gt;mapped.pgshift\n(an unsigned long value) could result in undefined behavior.\n\nThe constant \u0026quot;1\u0026quot; defaults to a 32-bit \u0026quot;int\u0026quot;, and when \u0026quot;pgshift\u0026quot; exceeds\n31 (e.g., pgshift = 63) the shift operation overflows, as the result\ncannot be represented in a 32-bit type.\n\nTo resolve this, the constant is updated to \u0026quot;1UL\u0026quot;, promoting it to an\nunsigned long type to match the operand\u0026apos;s type.(CVE-2025-21724)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix oops due to unset link speed\n\nIt isn\u0026apos;t guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always\nbe set by the server, so the client must handle any values and then\nprevent oopses like below from happening:\n\nOops: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 1323 Comm: cat Not tainted 6.13.0-rc7 #2\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41\n04/01/2014\nRIP: 0010:cifs_debug_data_proc_show+0xa45/0x1460 [cifs] Code: 00 00 48\n89 df e8 3b cd 1b c1 41 f6 44 24 2c 04 0f 84 50 01 00 00 48 89 ef e8\ne7 d0 1b c1 49 8b 44 24 18 31 d2 49 8d 7c 24 28 \u0026lt;48\u0026gt; f7 74 24 18 48 89\nc3 e8 6e cf 1b c1 41 8b 6c 24 28 49 8d 7c 24\nRSP: 0018:ffffc90001817be0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff88811230022c RCX: ffffffffc041bd99\nRDX: 0000000000000000 RSI: 0000000000000567 RDI: ffff888112300228\nRBP: ffff888112300218 R08: fffff52000302f5f R09: ffffed1022fa58ac\nR10: ffff888117d2c566 R11: 00000000fffffffe R12: ffff888112300200\nR13: 000000012a15343f R14: 0000000000000001 R15: ffff888113f2db58\nFS: 00007fe27119e740(0000) GS:ffff888148600000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe2633c5000 CR3: 0000000124da0000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die_body.cold+0x19/0x27\n ? die+0x2e/0x50\n ? do_trap+0x159/0x1b0\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? do_error_trap+0x90/0x130\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? exc_divide_error+0x39/0x50\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? asm_exc_divide_error+0x1a/0x20\n ? cifs_debug_data_proc_show+0xa39/0x1460 [cifs]\n ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]\n ? seq_read_iter+0x42e/0x790\n seq_read_iter+0x19a/0x790\n proc_reg_read_iter+0xbe/0x110\n ? __pfx_proc_reg_read_iter+0x10/0x10\n vfs_read+0x469/0x570\n ? do_user_addr_fault+0x398/0x760\n ? __pfx_vfs_read+0x10/0x10\n ? find_held_lock+0x8a/0xa0\n ? __pfx_lock_release+0x10/0x10\n ksys_read+0xd3/0x170\n ? __pfx_ksys_read+0x10/0x10\n ? __rcu_read_unlock+0x50/0x270\n ? mark_held_locks+0x1a/0x90\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe271288911\nCode: 00 48 8b 15 01 25 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8\n20 ad 01 00 f3 0f 1e fa 80 3d b5 a7 10 00 00 74 13 31 c0 0f 05 \u0026lt;48\u0026gt; 3d\n00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec\nRSP: 002b:00007ffe87c079d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007fe271288911\nRDX: 0000000000040000 RSI: 00007fe2633c6000 RDI: 0000000000000003\nRBP: 00007ffe87c07a00 R08: 0000000000000000 R09: 00007fe2713e6380\nR10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000\nR13: 00007fe2633c6000 R14: 0000000000000003 R15: 0000000000000000\n \u0026lt;/TASK\u0026gt;\n\nFix this by setting cifs_server_iface::speed to a sane value (1Gbps)\nby default when link speed is unset.(CVE-2025-21725)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npadata: avoid UAF for reorder_work\n\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\ncan not avoid potential UAF issue for reorder_work. This issue can\nhappen just as below:\n\ncrypto_request\t\t\tcrypto_request\t\tcrypto_del_alg\npadata_do_serial\n  ...\n  padata_reorder\n    // processes all remaining\n    // requests then breaks\n    while (1) {\n      if (!padata)\n        break;\n      ...\n    }\n\n\t\t\t\tpadata_do_serial\n\t\t\t\t  // new request added\n\t\t\t\t  list_add\n    // sees the new request\n    queue_work(reorder_work)\n\t\t\t\t  padata_reorder\n\t\t\t\t    queue_work_on(squeue-\u0026gt;work)\n...\n\n\t\t\t\t\u0026lt;kworker context\u0026gt;\n\t\t\t\tpadata_serial_worker\n\t\t\t\t// completes new request,\n\t\t\t\t// no more outstanding\n\t\t\t\t// requests\n\n\t\t\t\t\t\t\tcrypto_del_alg\n\t\t\t\t\t\t\t  // free pd\n\n\u0026lt;kworker context\u0026gt;\ninvoke_padata_reorder\n  // UAF of pd\n\nTo avoid UAF for \u0026apos;reorder_work\u0026apos;, get \u0026apos;pd\u0026apos; ref before put \u0026apos;reorder_work\u0026apos;\ninto the \u0026apos;serial_wq\u0026apos; and put \u0026apos;pd\u0026apos; ref until the \u0026apos;serial_wq\u0026apos; finish.(CVE-2025-21726)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npadata: fix UAF in padata_reorder\n\nA bug was found when run ltp test:\n\nBUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0\nRead of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206\n\nCPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+\nWorkqueue: pdecrypt_parallel padata_parallel_worker\nCall Trace:\n\u0026lt;TASK\u0026gt;\ndump_stack_lvl+0x32/0x50\nprint_address_description.constprop.0+0x6b/0x3d0\nprint_report+0xdd/0x2c0\nkasan_report+0xa5/0xd0\npadata_find_next+0x29/0x1a0\npadata_reorder+0x131/0x220\npadata_parallel_worker+0x3d/0xc0\nprocess_one_work+0x2ec/0x5a0\n\nIf \u0026apos;mdelay(10)\u0026apos; is added before calling \u0026apos;padata_find_next\u0026apos; in the\n\u0026apos;padata_reorder\u0026apos; function, this issue could be reproduced easily with\nltp test (pcrypt_aead01).\n\nThis can be explained as bellow:\n\npcrypt_aead_encrypt\n...\npadata_do_parallel\nrefcount_inc(\u0026amp;pd-\u0026gt;refcnt); // add refcnt\n...\npadata_do_serial\npadata_reorder // pd\nwhile (1) {\npadata_find_next(pd, true); // using pd\nqueue_work_on\n...\npadata_serial_worker\t\t\t\tcrypto_del_alg\npadata_put_pd_cnt // sub refcnt\n\t\t\t\t\t\tpadata_free_shell\n\t\t\t\t\t\tpadata_put_pd(ps-\u0026gt;pd);\n\t\t\t\t\t\t// pd is freed\n// loop again, but pd is freed\n// call padata_find_next, UAF\n}\n\nIn the padata_reorder function, when it loops in \u0026apos;while\u0026apos;, if the alg is\ndeleted, the refcnt may be decreased to 0 before entering\n\u0026apos;padata_find_next\u0026apos;, which leads to UAF.\n\nAs mentioned in [1], do_serial is supposed to be called with BHs disabled\nand always happen under RCU protection, to address this issue, add\nsynchronize_rcu() in \u0026apos;padata_free_shell\u0026apos; wait for all _do_serial calls\nto finish.\n\n[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/\n[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/(CVE-2025-21727)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Send signals asynchronously if !preemptible\n\nBPF programs can execute in all kinds of contexts and when a program\nrunning in a non-preemptible context uses the bpf_send_signal() kfunc,\nit will cause issues because this kfunc can sleep.\nChange `irqs_disabled()` to `!preemptible()`.(CVE-2025-21728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix class @block_class\u0026apos;s subsystem refcount leakage\n\nblkcg_fill_root_iostats() iterates over @block_class\u0026apos;s devices by\nclass_dev_iter_(init|next)(), but does not end iterating with\nclass_dev_iter_exit(), so causes the class\u0026apos;s subsystem refcount leakage.\n\nFix by ending the iterating with class_dev_iter_exit().(CVE-2025-21745)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()\n\nWhen getting the IRQ we use k3_udma_glue_tx_get_irq() which returns\nnegative error value on error. So not NULL check is not sufficient\nto deteremine if IRQ is valid. Check that IRQ is greater then zero\nto ensure it is valid.\n\nThere is no issue at probe time but at runtime user can invoke\n.set_channels which results in the following call chain.\nam65_cpsw_set_channels()\n am65_cpsw_nuss_update_tx_rx_chns()\n  am65_cpsw_nuss_remove_tx_chns()\n  am65_cpsw_nuss_init_tx_chns()\n\nAt this point if am65_cpsw_nuss_init_tx_chns() fails due to\nk3_udma_glue_tx_get_irq() then tx_chn-\u0026gt;irq will be set to a\nnegative value.\n\nThen, at subsequent .set_channels with higher channel count we\nwill attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns()\nleading to a kernel warning.\n\nThe issue is present in the original commit that introduced this driver,\nalthough there, am65_cpsw_nuss_update_tx_rx_chns() existed as\nam65_cpsw_nuss_update_tx_chns().(CVE-2025-21799)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix warnings during S3 suspend\n\nThe enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(),\nand the later one may call the preempt_schedule_common() function,\nresulting in a thread switch and causing the CPU to be in an interrupt\nenabled state after the enable_gpe_wakeup() function returns, leading\nto the warnings as follow.\n\n[ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8\n[ C0]          ...\n[ C0] Call Trace:\n[ C0] [\u0026lt;90000000002243b4\u0026gt;] show_stack+0x64/0x188\n[ C0] [\u0026lt;900000000164673c\u0026gt;] dump_stack_lvl+0x60/0x88\n[ C0] [\u0026lt;90000000002687e4\u0026gt;] __warn+0x8c/0x148\n[ C0] [\u0026lt;90000000015e9978\u0026gt;] report_bug+0x1c0/0x2b0\n[ C0] [\u0026lt;90000000016478e4\u0026gt;] do_bp+0x204/0x3b8\n[ C0] [\u0026lt;90000000025b1924\u0026gt;] exception_handlers+0x1924/0x10000\n[ C0] [\u0026lt;9000000000343bbc\u0026gt;] ktime_get+0xbc/0xc8\n[ C0] [\u0026lt;9000000000354c08\u0026gt;] tick_sched_timer+0x30/0xb0\n[ C0] [\u0026lt;90000000003408e0\u0026gt;] __hrtimer_run_queues+0x160/0x378\n[ C0] [\u0026lt;9000000000341f14\u0026gt;] hrtimer_interrupt+0x144/0x388\n[ C0] [\u0026lt;9000000000228348\u0026gt;] constant_timer_interrupt+0x38/0x48\n[ C0] [\u0026lt;90000000002feba4\u0026gt;] __handle_irq_event_percpu+0x64/0x1e8\n[ C0] [\u0026lt;90000000002fed48\u0026gt;] handle_irq_event_percpu+0x20/0x80\n[ C0] [\u0026lt;9000000000306b9c\u0026gt;] handle_percpu_irq+0x5c/0x98\n[ C0] [\u0026lt;90000000002fd4a0\u0026gt;] generic_handle_domain_irq+0x30/0x48\n[ C0] [\u0026lt;9000000000d0c7b0\u0026gt;] handle_cpu_irq+0x70/0xa8\n[ C0] [\u0026lt;9000000001646b30\u0026gt;] handle_loongarch_irq+0x30/0x48\n[ C0] [\u0026lt;9000000001646bc8\u0026gt;] do_vint+0x80/0xe0\n[ C0] [\u0026lt;90000000002aea1c\u0026gt;] finish_task_switch.isra.0+0x8c/0x2a8\n[ C0] [\u0026lt;900000000164e34c\u0026gt;] __schedule+0x314/0xa48\n[ C0] [\u0026lt;900000000164ead8\u0026gt;] schedule+0x58/0xf0\n[ C0] [\u0026lt;9000000000294a2c\u0026gt;] worker_thread+0x224/0x498\n[ C0] [\u0026lt;900000000029d2f0\u0026gt;] kthread+0xf8/0x108\n[ C0] [\u0026lt;9000000000221f28\u0026gt;] ret_from_kernel_thread+0xc/0xa4\n[ C0]\n[ C0] ---[ end trace 0000000000000000 ]---\n\nThe root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect\nacpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause\na thread switch. Since there is no longer concurrent execution during\nloongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes()\ndirectly in enable_gpe_wakeup().\n\nThe solution is similar to commit 22db06337f590d01 (\u0026quot;ACPI: sleep: Avoid\nbreaking S3 wakeup due to might_sleep()\u0026quot;).(CVE-2025-21803)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()\n\nThe rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region()\nmacro to request a needed resource. A string variable that lives on the\nstack is then used to store a dynamically computed resource name, which\nis then passed on as one of the macro arguments. This can lead to\nundefined behavior.\n\nDepending on the current contents of the memory, the manifestations of\nerrors may vary. One possible output may be as follows:\n\n  $ cat /proc/iomem\n  30000000-37ffffff :\n  38000000-3fffffff :\n\nSometimes, garbage may appear after the colon.\n\nIn very rare cases, if no NULL-terminator is found in memory, the system\nmight crash because the string iterator will overrun which can lead to\naccess of unmapped memory above the stack.\n\nThus, fix this by replacing outbound_name with the name of the previously\nrequested resource. With the changes applied, the output will be as\nfollows:\n\n  $ cat /proc/iomem\n  30000000-37ffffff : memory2\n  38000000-3fffffff : memory3\n\n[kwilczynski: commit log](CVE-2025-21804)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: let net.core.dev_weight always be non-zero\n\nThe following problem was encountered during stability test:\n\n(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \\\n\treturned 1, exceeding its budget of 0.\n------------[ cut here ]------------\nlist_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \\\n\tnext=ffff88905f746e40.\nWARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \\\n\t__list_add_valid_or_report+0xf3/0x130\nCPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+\nRIP: 0010:__list_add_valid_or_report+0xf3/0x130\nCall Trace:\n? __warn+0xcd/0x250\n? __list_add_valid_or_report+0xf3/0x130\nenqueue_to_backlog+0x923/0x1070\nnetif_rx_internal+0x92/0x2b0\n__netif_rx+0x15/0x170\nloopback_xmit+0x2ef/0x450\ndev_hard_start_xmit+0x103/0x490\n__dev_queue_xmit+0xeac/0x1950\nip_finish_output2+0x6cc/0x1620\nip_output+0x161/0x270\nip_push_pending_frames+0x155/0x1a0\nraw_sendmsg+0xe13/0x1550\n__sys_sendto+0x3bf/0x4e0\n__x64_sys_sendto+0xdc/0x1b0\ndo_syscall_64+0x5b/0x170\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe reproduction command is as follows:\n  sysctl -w net.core.dev_weight=0\n  ping 127.0.0.1\n\nThis is because when the napi\u0026apos;s weight is set to 0, process_backlog() may\nreturn 0 and clear the NAPI_STATE_SCHED bit of napi-\u0026gt;state, causing this\nnapi to be re-polled in net_rx_action() until __do_softirq() times out.\nSince the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can\nbe retriggered in enqueue_to_backlog(), causing this issue.\n\nMaking the napi\u0026apos;s weight always non-zero solves this problem.\n\nTriggering this issue requires system-wide admin (setting is\nnot namespaced).(CVE-2025-21806)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can\u0026apos;t work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode.(CVE-2025-21808)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: class: Fix wild pointer dereferences in API class_dev_iter_next()\n\nThere are a potential wild pointer dereferences issue regarding APIs\nclass_dev_iter_(init|next|exit)(), as explained by below typical usage:\n\n// All members of @iter are wild pointers.\nstruct class_dev_iter iter;\n\n// class_dev_iter_init(@iter, @class, ...) checks parameter @class for\n// potential class_to_subsys() error, and it returns void type and does\n// not initialize its output parameter @iter, so caller can not detect\n// the error and continues to invoke class_dev_iter_next(@iter) even if\n// @iter still contains wild pointers.\nclass_dev_iter_init(\u0026amp;iter, ...);\n\n// Dereference these wild pointers in @iter here once suffer the error.\nwhile (dev = class_dev_iter_next(\u0026amp;iter)) { ... };\n\n// Also dereference these wild pointers here.\nclass_dev_iter_exit(\u0026amp;iter);\n\nActually, all callers of these APIs have such usage pattern in kernel tree.\nFix by:\n- Initialize output parameter @iter by memset() in class_dev_iter_init()\n  and give callers prompt by pr_crit() for the error.\n- Check if @iter is valid in class_dev_iter_next().(CVE-2025-21810)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: protect access to buffers with no active references\n\nnilfs_lookup_dirty_data_buffers(), which iterates through the buffers\nattached to dirty data folios/pages, accesses the attached buffers without\nlocking the folios/pages.\n\nFor data cache, nilfs_clear_folio_dirty() may be called asynchronously\nwhen the file system degenerates to read only, so\nnilfs_lookup_dirty_data_buffers() still has the potential to cause use\nafter free issues when buffers lose the protection of their dirty state\nmidway due to this asynchronous clearing and are unintentionally freed by\ntry_to_free_buffers().\n\nEliminate this race issue by adjusting the lock section in this function.(CVE-2025-21811)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nax25: rcu protect dev-\u0026gt;ax25_ptr\n\nsyzbot found a lockdep issue [1].\n\nWe should remove ax25 RTNL dependency in ax25_setsockopt()\n\nThis should also fix a variety of possible UAF in ax25.\n\n[1]\n\nWARNING: possible circular locking dependency detected\n6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted\n------------------------------------------------------\nsyz.5.1818/12806 is trying to acquire lock:\n ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n\nbut task is already holding lock:\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #1 (sk_lock-AF_AX25){+.+.}-{0:0}:\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n        lock_sock_nested+0x48/0x100 net/core/sock.c:3642\n        lock_sock include/net/sock.h:1618 [inline]\n        ax25_kill_by_device net/ax25/af_ax25.c:101 [inline]\n        ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146\n        notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85\n       __dev_notify_flags+0x207/0x400\n        dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026\n        dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563\n        dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820\n        sock_do_ioctl+0x240/0x460 net/socket.c:1234\n        sock_ioctl+0x626/0x8e0 net/socket.c:1339\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:906 [inline]\n        __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-\u0026gt; #0 (rtnl_mutex){+.+.}-{4:4}:\n        check_prev_add kernel/locking/lockdep.c:3161 [inline]\n        check_prevs_add kernel/locking/lockdep.c:3280 [inline]\n        validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904\n        __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n        __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n        __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735\n        ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n        do_sock_setsockopt+0x3af/0x720 net/socket.c:2324\n        __sys_setsockopt net/socket.c:2349 [inline]\n        __do_sys_setsockopt net/socket.c:2355 [inline]\n        __se_sys_setsockopt net/socket.c:2352 [inline]\n        __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nother info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(sk_lock-AF_AX25);\n                               lock(rtnl_mutex);\n                               lock(sk_lock-AF_AX25);\n  lock(rtnl_mutex);\n\n *** DEADLOCK ***\n\n1 lock held by syz.5.1818/12806:\n  #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n  #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074\n  check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206\n  check_prev_add kernel/locking/lockdep.c:3161 [inline]\n  check_prevs_add kernel/lockin\n---truncated---(CVE-2025-21812)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0026apos;t flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this.(CVE-2025-21828)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: avoid holding freeze_mutex during mmap operation\n\nWe use map-\u0026gt;freeze_mutex to prevent races between map_freeze() and\nmemory mapping BPF map contents with writable permissions. The way we\nnaively do this means we\u0026apos;ll hold freeze_mutex for entire duration of all\nthe mm and VMA manipulations, which is completely unnecessary. This can\npotentially also lead to deadlocks, as reported by syzbot in [0].\n\nSo, instead, hold freeze_mutex only during writeability checks, bump\n(proactively) \u0026quot;write active\u0026quot; count for the map, unlock the mutex and\nproceed with mmap logic. And only if something went wrong during mmap\nlogic, then undo that \u0026quot;write active\u0026quot; counter increment.\n\n  [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/(CVE-2025-21853)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:18:17.218519035Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-21710","description":"In the Linux kernel, the following vulnerability has been resolved: tcp: correct handling of extreme memory squeeze Testing with iperf3 using the \"pasta\" protocol splicer has revealed a problem in the way tcp handles window advertising in extreme memory squeeze situations. Under memory pressure, a socket endpoint may temporarily advertise a zero-sized window, but this is not stored as part of the socket data. The reasoning behind this is that it is considered a temporary setting which shouldn't influence any further calculations. However, if we happen to stall at an unfortunate value of the current window size, the algorithm selecting a new value will consistently fail to advertise a non-zero window once we have freed up enough memory. This means that this side's notion of the current window size is different from the one last advertised to the peer, causing the latter to not send any data to resolve the sitution. The problem occurs on the iperf3 server side, and the socket in question is a completely regular socket with the default settings for the fedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket. The following excerpt of a logging session, with own comments added, shows more in detail what is happening: //              tcp_v4_rcv(-\u003e) //                tcp_rcv_established(-\u003e) [5201\u003c-\u003e39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ==== [5201\u003c-\u003e39222]:     tcp_data_queue(-\u003e) [5201\u003c-\u003e39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM                        [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]                        [copied_seq 259909392-\u003e260034360 (124968), unread 5565800, qlen 85, ofoq 0]                        [OFO queue: gap: 65480, len: 0] [5201\u003c-\u003e39222]:     tcp_data_queue(\u003c-) [5201\u003c-\u003e39222]:     __tcp_transmit_skb(-\u003e)                         [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160] [5201\u003c-\u003e39222]:       tcp_select_window(-\u003e) [5201\u003c-\u003e39222]:         (inet_csk(sk)-\u003eicsk_ack.pending \u0026 ICSK_ACK_NOMEM) ? --\u003e TRUE                         [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160]                         returning 0 [5201\u003c-\u003e39222]:       tcp_select_window(\u003c-) [5201\u003c-\u003e39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160 [5201\u003c-\u003e39222]:     [__tcp_transmit_skb(\u003c-) [5201\u003c-\u003e39222]:   tcp_rcv_established(\u003c-) [5201\u003c-\u003e39222]: tcp_v4_rcv(\u003c-) // Receive queue is at 85 buffers and we are out of memory. // We drop the incoming buffer, although it is in sequence, and decide // to send an advertisement with a window of zero. // We don't update tp-\u003ercv_wnd and tp-\u003ercv_wup accordingly, which means // we unconditionally shrink the window. [5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e) [5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160 [5201\u003c-\u003e39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368] [5201\u003c-\u003e39222]:     [new_win \u003e= (2 * win_now) ? --\u003e time_to_ack = 0] [5201\u003c-\u003e39222]:     NOT calling tcp_send_ack()                     [tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160] [5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(\u003c-)                   [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]                   [copied_seq 260040464-\u003e260040464 (0), unread 5559696, qlen 85, ofoq 0]                   returning 6104 bytes [5201\u003c-\u003e39222]: tcp_recvmsg_locked(\u003c-) // After each read, the algorithm for calculating the new receive // window in __tcp_cleanup_rbuf() finds it is too small to advertise // or to update tp-\u003ercv_wnd. // Meanwhile, the peer thinks the window is zero, and will not send // any more data to trigger an update from the interrupt mode side. [5201\u003c-\u003e39222]: tcp_recvmsg_locked(-\u003e) [5201\u003c-\u003e39222]:   __tcp_cleanup_rbuf(-\u003e) tp-\u003ercv_wup: 265469200, tp-\u003ercv_wnd: 262144, tp-\u003ercv_nxt 265600160 [5201\u003c-\u003e39222]:     [new_win = 262144, win_now = 131184, 2 * win_n ---truncated---","status":"published","published":"2025-02-27T02:15:00Z","modified":"2026-10-08T12:52:52.508384741Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:22.579335Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-21710","title":"CVE-2025-21710 in linux - Patched by Root","description":"Root has patched CVE-2025-21710 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:17:43.216665557Z","updated_at":"2026-11-06T16:59:12.24096Z"},{"id":"SUSE-SU-2025:4393-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n\nThe following non security issues were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tas2781: fix getting the wrong device number (git-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (git-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: s390: improve interrupt cpu for wakeup (bsc#1235463).\n- KVM: s390: kABI backport for 'last_sleep_cpu' (bsc#1252352).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Don't treat ENTER and LEAVE as branches, because they aren't (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- KVM: x86: Have all vendor neutral sub-configs depend on KVM_X86, not just KVM (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (git-fixes).\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes).\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes).\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes).\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes).\n- RDMA/irdma: Fix SD index calculation (git-fixes).\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- acpi/hmat: Fix lockdep warning for hmem_register_resource() (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (git-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- bpf: Fix test verif_scale_strobemeta_subprogs failure due to llvm19 (bsc#1252368).\n- bpf: improve error message for unsupported helper (bsc#1252370).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/amdgpu: Release xcp drm memory after unplug (stable-fixes).\n- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Add fallback path for YCBCR422 (stable-fixes).\n- drm/amd/display: Allow VRR params change if unsynced with the stream (git-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Enable mst when it's detected but yet to be initialized (git-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Fix for test crash due to power gating (stable-fixes).\n- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (stable-fixes).\n- drm/amd/display: Fix pbn_div Calculation Error (stable-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (stable-fixes).\n- drm/amd/display: Init dispclk from bootup clock for DCN314 (stable-fixes).\n- drm/amd/display: Move setup_stream_attribute (stable-fixes).\n- drm/amd/display: Reject modes with too high pixel clock on DCE6-10 (git-fixes).\n- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (stable-fixes).\n- drm/amd/display: Set up pixel encoding for YCBCR422 (stable-fixes).\n- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (stable-fixes).\n- drm/amd/display: Wait until OTG enable state is cleared (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: change dc stream color settings only in atomic commit (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: fix condition for setting timing_adjust_pending (stable-fixes).\n- drm/amd/display: fix dml ms order of operations (stable-fixes).\n- drm/amd/display: incorrect conditions for failing dto calculations (stable-fixes).\n- drm/amd/display: update color on atomic commit time (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Check that VPE has reached DPM0 in idle handler (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu/smu: Handle S0ix for vangogh (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Check vcn sram load return value (stable-fixes).\n- drm/amdgpu: Correct the counts of nr_banks and nr_errors (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Fix function header names in amdgpu_connectors.c (git-fixes).\n- drm/amdgpu: Fix unintended error log in VCN5_0_0 (git-fixes).\n- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (stable-fixes).\n- drm/amdgpu: Skip poison aca bank from UE channel (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add range check for RAS bad page address (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (stable-fixes).\n- drm/amdgpu: don't enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: fix nullptr err of vm_handle_moved (stable-fixes).\n- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdgpu: remove two invalid BUG_ON()s (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: relax checks for over allocation of save area (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off (git-fixes).\n- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/exynos: exynos7_drm_decon: remove ctx-\u003esuspended (git-fixes).\n- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/mediatek: Add pm_runtime support for GCE power control (git-fixes).\n- drm/mediatek: Disable AFBC support on Mediatek DRM driver (git-fixes).\n- drm/msm/a6xx: Fix PDC sleep sequence (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm/registers: Generate _HI/LO builders for reg64 (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/panthor: Serialize GPU cache flush operations (stable-fixes).\n- drm/panthor: check bo offset alignment in vm bind (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/sched: Optimise drm_sched_entity_push_job (stable-fixes).\n- drm/sched: avoid killing parent entity on child SIGKILL (stable-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- drm/xe/guc: Add more GuC load error status codes (stable-fixes).\n- drm/xe/guc: Increase GuC crash dump buffer size (stable-fixes).\n- drm/xe/guc: Return an error code if the GuC load fails (stable-fixes).\n- drm/xe/guc: Set upper limit of H2G retries over CTB (stable-fixes).\n- drm/xe/guc: Synchronize Dead CT worker with unbind (git-fixes).\n- drm/xe: Do clean shutdown also when using flr (git-fixes).\n- drm/xe: Do not wake device during a GT reset (git-fixes).\n- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test (stable-fixes).\n- drm/xe: Move declarations under conditional branch (stable-fixes).\n- drm/xe: Remove duplicate DRM_EXEC selection from Kconfig (git-fixes).\n- drm: panel-backlight-quirks: Make EDID match optional (stable-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- hyperv: Remove the spurious null directive line (git-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- media: videobuf2: forbid remove_bufs when legacy fileio is active (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- nvme-auth: add hkdf_expand_label() (bsc#1247683).\n- nvme-auth: use hkdf_expand_label() (bsc#1247683).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Check for timeout in perf_link test (bsc#1253648).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Remove sockmap_ktls disconnect_after_delete test (bsc#1252365).\n- selftests/bpf: Remove tests for zeroed-array kptr (bsc#1252366).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- selftests/net/forwarding: add slowwait functions (bsc#1254235).\n- selftests/net/lib: no need to record ns name if it already exist (bsc#1254235).\n- selftests/net/lib: update busywait timeout value (bsc#1254235).\n- selftests/net: add lib.sh (bsc#1254235).\n- selftests/net: add variable NS_LIST for lib.sh (bsc#1254235).\n- selftests/net: use tc rule to filter the na packet (bsc#1254235).\n- selftests/run_kselftest.sh: Add `--skip` argument option (bsc#1254221).\n- selftests: forwarding.config.sample: Move overrides to lib.sh (bsc#1254235).\n- selftests: forwarding: Add a test for testing lib.sh functionality (bsc#1254235).\n- selftests: forwarding: Avoid failures to source net/lib.sh (bsc#1254235).\n- selftests: forwarding: Change inappropriate log_test_skip() calls (bsc#1254235).\n- selftests: forwarding: Convert log_test() to recognize RET values (bsc#1254235).\n- selftests: forwarding: Have RET track kselftest framework constants (bsc#1254235).\n- selftests: forwarding: Parametrize mausezahn delay (bsc#1254235).\n- selftests: forwarding: Redefine relative_path variable (bsc#1254235).\n- selftests: forwarding: Remove duplicated lib.sh content (bsc#1254235).\n- selftests: forwarding: Support for performance sensitive tests (bsc#1254235).\n- selftests: lib: Define more kselftest exit codes (bsc#1254235).\n- selftests: lib: tc_rule_stats_get(): Move default to argument definition (bsc#1254235).\n- selftests: net: List helper scripts in TEST_FILES Makefile variable (bsc#1254235).\n- selftests: net: Unify code of busywait() and slowwait() (bsc#1254235).\n- selftests: net: add helper for checking if nettest is available (bsc#1254235).\n- selftests: net: lib: Do not overwrite error messages (bsc#1254235).\n- selftests: net: lib: Move logging from forwarding/lib.sh here (bsc#1254235).\n- selftests: net: lib: avoid error removing empty netns name (bsc#1254235).\n- selftests: net: lib: do not set ns var as readonly (bsc#1254235).\n- selftests: net: lib: fix shift count out of range (bsc#1254235).\n- selftests: net: lib: ignore possible errors (bsc#1254235).\n- selftests: net: lib: kill PIDs before del netns (bsc#1254235).\n- selftests: net: lib: remove 'ns' var in setup_ns (bsc#1254235).\n- selftests: net: lib: remove ns from list after clean-up (bsc#1254235).\n- selftests: net: lib: set 'i' as local (bsc#1254235).\n- selftests: net: lib: support errexit with busywait (bsc#1254235).\n- selftests: net: libs: Change variable fallback syntax (bsc#1254235).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Don't use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/hv: fcopy: Fix incorrect file path conversion (git-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: don't preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: Add quirk entries for Thinkpad T14s Gen3 AMD (bsc#1254181).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (stable-fixes).\n- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: Track NAN interface start/stop (stable-fixes).\n- wifi: mac80211: don't mark keys for inactive links as uploaded (stable-fixes).\n- wifi: mac80211: fix key tailroom accounting leak (git-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: rtw89: print just once for unknown C2H events (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xe/oa: Fix query mode of operation for OAR/OAC (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2025-12-15T11:09:08Z","modified":"2026-03-23T04:51:30.857607Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4422-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n\nThe following non security issues were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Don't treat ENTER and LEAVE as branches, because they aren't (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (git-fixes).\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes).\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes).\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes).\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes).\n- RDMA/irdma: Fix SD index calculation (git-fixes).\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: don't enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Don't use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: don't preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2025-12-17T10:52:47Z","modified":"2026-03-23T04:51:31.991873Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4505-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes).\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes).\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes).\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes).\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes).\n- RDMA/irdma: Fix SD index calculation (git-fixes).\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes).\n- Revert 'drm/tegra: dsi: Clear enable register if powered by bootloader' (git-fixes).\n- Revert 'wifi: ath10k: avoid unnecessary wait for service ready message' (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- kabi/severities: drop xfer_to_guest_mode_handle_work.\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- powerpc: export MIN RMA size (bsc#1236743).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743, bsc#1252269).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2025-12-22T16:35:13Z","modified":"2026-02-04T04:27:58.583618Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2025:4516-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n- CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tas2781: fix getting the wrong device number (git-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (git-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- Fix 'drm/xe: Do not allow evicting of BOs in same VM in array of VM binds' (bsc#1252923).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: s390: improve interrupt cpu for wakeup (bsc#1235463).\n- KVM: s390: kABI backport for 'last_sleep_cpu' (bsc#1252352).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- KVM: x86: Have all vendor neutral sub-configs depend on KVM_X86, not just KVM (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes)\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes)\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes).\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes).\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes).\n- RDMA/irdma: Fix SD index calculation (git-fixes).\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes)\n- Revert 'drm/tegra: dsi: Clear enable register if powered by bootloader' (git-fixes).\n- Revert 'wifi: ath10k: avoid unnecessary wait for service ready message' (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- acpi/hmat: Fix lockdep warning for hmem_register_resource() (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (git-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- bpf: Fix test verif_scale_strobemeta_subprogs failure due to llvm19 (bsc#1252368).\n- bpf: improve error message for unsupported helper (bsc#1252370).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/amdgpu: Release xcp drm memory after unplug (stable-fixes).\n- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Add fallback path for YCBCR422 (stable-fixes).\n- drm/amd/display: Allow VRR params change if unsynced with the stream (git-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Enable mst when it's detected but yet to be initialized (git-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Fix for test crash due to power gating (stable-fixes).\n- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (stable-fixes).\n- drm/amd/display: Fix pbn_div Calculation Error (stable-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (stable-fixes).\n- drm/amd/display: Init dispclk from bootup clock for DCN314 (stable-fixes).\n- drm/amd/display: Move setup_stream_attribute (stable-fixes).\n- drm/amd/display: Reject modes with too high pixel clock on DCE6-10 (git-fixes).\n- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (stable-fixes).\n- drm/amd/display: Set up pixel encoding for YCBCR422 (stable-fixes).\n- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (stable-fixes).\n- drm/amd/display: Wait until OTG enable state is cleared (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: change dc stream color settings only in atomic commit (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: fix condition for setting timing_adjust_pending (stable-fixes).\n- drm/amd/display: fix dml ms order of operations (stable-fixes).\n- drm/amd/display: incorrect conditions for failing dto calculations (stable-fixes).\n- drm/amd/display: update color on atomic commit time (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Check that VPE has reached DPM0 in idle handler (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu/smu: Handle S0ix for vangogh (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Check vcn sram load return value (stable-fixes).\n- drm/amdgpu: Correct the counts of nr_banks and nr_errors (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Fix function header names in amdgpu_connectors.c (git-fixes).\n- drm/amdgpu: Fix unintended error log in VCN5_0_0 (git-fixes).\n- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (stable-fixes).\n- drm/amdgpu: Skip poison aca bank from UE channel (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add range check for RAS bad page address (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: fix nullptr err of vm_handle_moved (stable-fixes).\n- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdgpu: remove two invalid BUG_ON()s (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: relax checks for over allocation of save area (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off (git-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/exynos: exynos7_drm_decon: remove ctx-\u003esuspended (git-fixes).\n- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/mediatek: Add pm_runtime support for GCE power control (git-fixes).\n- drm/mediatek: Disable AFBC support on Mediatek DRM driver (git-fixes).\n- drm/msm/a6xx: Fix PDC sleep sequence (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm/registers: Generate _HI/LO builders for reg64 (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/panthor: Serialize GPU cache flush operations (stable-fixes).\n- drm/panthor: check bo offset alignment in vm bind (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/sched: Optimise drm_sched_entity_push_job (stable-fixes).\n- drm/sched: avoid killing parent entity on child SIGKILL (stable-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- drm/xe/guc: Add more GuC load error status codes (stable-fixes).\n- drm/xe/guc: Increase GuC crash dump buffer size (stable-fixes).\n- drm/xe/guc: Return an error code if the GuC load fails (stable-fixes).\n- drm/xe/guc: Set upper limit of H2G retries over CTB (stable-fixes).\n- drm/xe/guc: Synchronize Dead CT worker with unbind (git-fixes).\n- drm/xe: Do clean shutdown also when using flr (git-fixes).\n- drm/xe: Do not wake device during a GT reset (git-fixes).\n- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test (stable-fixes).\n- drm/xe: Move declarations under conditional branch (stable-fixes).\n- drm/xe: Remove duplicate DRM_EXEC selection from Kconfig (git-fixes).\n- drm: panel-backlight-quirks: Make EDID match optional (stable-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- hyperv: Remove the spurious null directive line (git-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes).\n- kabi/severities: drop xfer_to_guest_mode_handle_work.\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- media: videobuf2: forbid remove_bufs when legacy fileio is active (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- nvme-auth: add hkdf_expand_label() (bsc#1247683).\n- nvme-auth: use hkdf_expand_label() (bsc#1247683).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Check for timeout in perf_link test (bsc#1253648).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Remove sockmap_ktls disconnect_after_delete test (bsc#1252365).\n- selftests/bpf: Remove tests for zeroed-array kptr (bsc#1252366).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- selftests/net/forwarding: add slowwait functions (bsc#1254235).\n- selftests/net/lib: no need to record ns name if it already exist (bsc#1254235).\n- selftests/net/lib: update busywait timeout value (bsc#1254235).\n- selftests/net: add lib.sh (bsc#1254235).\n- selftests/net: add variable NS_LIST for lib.sh (bsc#1254235).\n- selftests/net: use tc rule to filter the na packet (bsc#1254235).\n- selftests/run_kselftest.sh: Add `--skip` argument option (bsc#1254221).\n- selftests: forwarding.config.sample: Move overrides to lib.sh (bsc#1254235).\n- selftests: forwarding: Add a test for testing lib.sh functionality (bsc#1254235).\n- selftests: forwarding: Avoid failures to source net/lib.sh (bsc#1254235).\n- selftests: forwarding: Change inappropriate log_test_skip() calls (bsc#1254235).\n- selftests: forwarding: Convert log_test() to recognize RET values (bsc#1254235).\n- selftests: forwarding: Have RET track kselftest framework constants (bsc#1254235).\n- selftests: forwarding: Parametrize mausezahn delay (bsc#1254235).\n- selftests: forwarding: Redefine relative_path variable (bsc#1254235).\n- selftests: forwarding: Remove duplicated lib.sh content (bsc#1254235).\n- selftests: forwarding: Support for performance sensitive tests (bsc#1254235).\n- selftests: lib: Define more kselftest exit codes (bsc#1254235).\n- selftests: lib: tc_rule_stats_get(): Move default to argument definition (bsc#1254235).\n- selftests: net: List helper scripts in TEST_FILES Makefile variable (bsc#1254235).\n- selftests: net: Unify code of busywait() and slowwait() (bsc#1254235).\n- selftests: net: add helper for checking if nettest is available (bsc#1254235).\n- selftests: net: lib: Do not overwrite error messages (bsc#1254235).\n- selftests: net: lib: Move logging from forwarding/lib.sh here (bsc#1254235).\n- selftests: net: lib: avoid error removing empty netns name (bsc#1254235).\n- selftests: net: lib: do not set ns var as readonly (bsc#1254235).\n- selftests: net: lib: fix shift count out of range (bsc#1254235).\n- selftests: net: lib: ignore possible errors (bsc#1254235).\n- selftests: net: lib: kill PIDs before del netns (bsc#1254235).\n- selftests: net: lib: remove 'ns' var in setup_ns (bsc#1254235).\n- selftests: net: lib: remove ns from list after clean-up (bsc#1254235).\n- selftests: net: lib: set 'i' as local (bsc#1254235).\n- selftests: net: lib: support errexit with busywait (bsc#1254235).\n- selftests: net: libs: Change variable fallback syntax (bsc#1254235).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/hv: fcopy: Fix incorrect file path conversion (git-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: Add quirk entries for Thinkpad T14s Gen3 AMD (bsc#1254181).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (stable-fixes).\n- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: Track NAN interface start/stop (stable-fixes).\n- wifi: mac80211: do not mark keys for inactive links as uploaded (stable-fixes).\n- wifi: mac80211: fix key tailroom accounting leak (git-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: rtw89: print just once for unknown C2H events (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xe/oa: Fix query mode of operation for OAR/OAC (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2025-12-23T16:27:39Z","modified":"2026-03-23T04:49:23.610108Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2025:4517-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tas2781: fix getting the wrong device number (git-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (git-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: s390: improve interrupt cpu for wakeup (bsc#1235463).\n- KVM: s390: kABI backport for 'last_sleep_cpu' (bsc#1252352).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- KVM: x86: Have all vendor neutral sub-configs depend on KVM_X86, not just KVM (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes).\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes).\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes).\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes).\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes).\n- RDMA/irdma: Fix SD index calculation (git-fixes).\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes).\n- Revert 'drm/tegra: dsi: Clear enable register if powered by bootloader' (git-fixes).\n- Revert 'wifi: ath10k: avoid unnecessary wait for service ready message' (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- acpi/hmat: Fix lockdep warning for hmem_register_resource() (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (git-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- bpf: Fix test verif_scale_strobemeta_subprogs failure due to llvm19 (bsc#1252368).\n- bpf: improve error message for unsupported helper (bsc#1252370).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/amdgpu: Release xcp drm memory after unplug (stable-fixes).\n- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Add fallback path for YCBCR422 (stable-fixes).\n- drm/amd/display: Allow VRR params change if unsynced with the stream (git-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Enable mst when it's detected but yet to be initialized (git-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Fix for test crash due to power gating (stable-fixes).\n- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (stable-fixes).\n- drm/amd/display: Fix pbn_div Calculation Error (stable-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (stable-fixes).\n- drm/amd/display: Init dispclk from bootup clock for DCN314 (stable-fixes).\n- drm/amd/display: Move setup_stream_attribute (stable-fixes).\n- drm/amd/display: Reject modes with too high pixel clock on DCE6-10 (git-fixes).\n- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (stable-fixes).\n- drm/amd/display: Set up pixel encoding for YCBCR422 (stable-fixes).\n- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (stable-fixes).\n- drm/amd/display: Wait until OTG enable state is cleared (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: change dc stream color settings only in atomic commit (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: fix condition for setting timing_adjust_pending (stable-fixes).\n- drm/amd/display: fix dml ms order of operations (stable-fixes).\n- drm/amd/display: incorrect conditions for failing dto calculations (stable-fixes).\n- drm/amd/display: update color on atomic commit time (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Check that VPE has reached DPM0 in idle handler (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu/smu: Handle S0ix for vangogh (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Check vcn sram load return value (stable-fixes).\n- drm/amdgpu: Correct the counts of nr_banks and nr_errors (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Fix function header names in amdgpu_connectors.c (git-fixes).\n- drm/amdgpu: Fix unintended error log in VCN5_0_0 (git-fixes).\n- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (stable-fixes).\n- drm/amdgpu: Skip poison aca bank from UE channel (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add range check for RAS bad page address (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: fix nullptr err of vm_handle_moved (stable-fixes).\n- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdgpu: remove two invalid BUG_ON()s (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: relax checks for over allocation of save area (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off (git-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/exynos: exynos7_drm_decon: remove ctx-\u003esuspended (git-fixes).\n- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/mediatek: Add pm_runtime support for GCE power control (git-fixes).\n- drm/mediatek: Disable AFBC support on Mediatek DRM driver (git-fixes).\n- drm/msm/a6xx: Fix PDC sleep sequence (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm/registers: Generate _HI/LO builders for reg64 (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/panthor: Serialize GPU cache flush operations (stable-fixes).\n- drm/panthor: check bo offset alignment in vm bind (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/sched: Optimise drm_sched_entity_push_job (stable-fixes).\n- drm/sched: avoid killing parent entity on child SIGKILL (stable-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- drm/xe/guc: Add more GuC load error status codes (stable-fixes).\n- drm/xe/guc: Increase GuC crash dump buffer size (stable-fixes).\n- drm/xe/guc: Return an error code if the GuC load fails (stable-fixes).\n- drm/xe/guc: Set upper limit of H2G retries over CTB (stable-fixes).\n- drm/xe/guc: Synchronize Dead CT worker with unbind (git-fixes).\n- drm/xe: Do clean shutdown also when using flr (git-fixes).\n- drm/xe: Do not wake device during a GT reset (git-fixes).\n- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test (stable-fixes).\n- drm/xe: Move declarations under conditional branch (stable-fixes).\n- drm/xe: Remove duplicate DRM_EXEC selection from Kconfig (git-fixes).\n- drm: panel-backlight-quirks: Make EDID match optional (stable-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- hyperv: Remove the spurious null directive line (git-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- kabi/severities: drop xfer_to_guest_mode_handle_work.\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- media: videobuf2: forbid remove_bufs when legacy fileio is active (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- nvme-auth: add hkdf_expand_label() (bsc#1247683).\n- nvme-auth: use hkdf_expand_label() (bsc#1247683).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- powerpc: export MIN RMA size (bsc#1236743).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743, bsc#1252269).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Check for timeout in perf_link test (bsc#1253648).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Remove sockmap_ktls disconnect_after_delete test (bsc#1252365).\n- selftests/bpf: Remove tests for zeroed-array kptr (bsc#1252366).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- selftests/net/forwarding: add slowwait functions (bsc#1254235).\n- selftests/net/lib: no need to record ns name if it already exist (bsc#1254235).\n- selftests/net/lib: update busywait timeout value (bsc#1254235).\n- selftests/net: add lib.sh (bsc#1254235).\n- selftests/net: add variable NS_LIST for lib.sh (bsc#1254235).\n- selftests/net: use tc rule to filter the na packet (bsc#1254235).\n- selftests/run_kselftest.sh: Add `--skip` argument option (bsc#1254221).\n- selftests: forwarding.config.sample: Move overrides to lib.sh (bsc#1254235).\n- selftests: forwarding: Add a test for testing lib.sh functionality (bsc#1254235).\n- selftests: forwarding: Avoid failures to source net/lib.sh (bsc#1254235).\n- selftests: forwarding: Change inappropriate log_test_skip() calls (bsc#1254235).\n- selftests: forwarding: Convert log_test() to recognize RET values (bsc#1254235).\n- selftests: forwarding: Have RET track kselftest framework constants (bsc#1254235).\n- selftests: forwarding: Parametrize mausezahn delay (bsc#1254235).\n- selftests: forwarding: Redefine relative_path variable (bsc#1254235).\n- selftests: forwarding: Remove duplicated lib.sh content (bsc#1254235).\n- selftests: forwarding: Support for performance sensitive tests (bsc#1254235).\n- selftests: lib: Define more kselftest exit codes (bsc#1254235).\n- selftests: lib: tc_rule_stats_get(): Move default to argument definition (bsc#1254235).\n- selftests: net: List helper scripts in TEST_FILES Makefile variable (bsc#1254235).\n- selftests: net: Unify code of busywait() and slowwait() (bsc#1254235).\n- selftests: net: add helper for checking if nettest is available (bsc#1254235).\n- selftests: net: lib: Do not overwrite error messages (bsc#1254235).\n- selftests: net: lib: Move logging from forwarding/lib.sh here (bsc#1254235).\n- selftests: net: lib: avoid error removing empty netns name (bsc#1254235).\n- selftests: net: lib: do not set ns var as readonly (bsc#1254235).\n- selftests: net: lib: fix shift count out of range (bsc#1254235).\n- selftests: net: lib: ignore possible errors (bsc#1254235).\n- selftests: net: lib: kill PIDs before del netns (bsc#1254235).\n- selftests: net: lib: remove 'ns' var in setup_ns (bsc#1254235).\n- selftests: net: lib: remove ns from list after clean-up (bsc#1254235).\n- selftests: net: lib: set 'i' as local (bsc#1254235).\n- selftests: net: lib: support errexit with busywait (bsc#1254235).\n- selftests: net: libs: Change variable fallback syntax (bsc#1254235).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/hv: fcopy: Fix incorrect file path conversion (git-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: Add quirk entries for Thinkpad T14s Gen3 AMD (bsc#1254181).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (stable-fixes).\n- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: Track NAN interface start/stop (stable-fixes).\n- wifi: mac80211: do not mark keys for inactive links as uploaded (stable-fixes).\n- wifi: mac80211: fix key tailroom accounting leak (git-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: rtw89: print just once for unknown C2H events (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xe/oa: Fix query mode of operation for OAR/OAC (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2025-12-23T16:28:51Z","modified":"2026-03-23T04:51:51.09247Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2025:4521-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes).\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes).\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes).\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes).\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes).\n- RDMA/irdma: Fix SD index calculation (git-fixes).\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes).\n- Revert 'drm/tegra: dsi: Clear enable register if powered by bootloader' (git-fixes).\n- Revert 'wifi: ath10k: avoid unnecessary wait for service ready message' (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- kabi/severities: drop xfer_to_guest_mode_handle_work.\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2025-12-24T12:42:49Z","modified":"2026-03-23T04:49:23.294846Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20039-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: net: dst_cache: annotate data-races around dst_cache-\u003ereset_ts (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n- CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes)\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes)\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes)\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes)\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes)\n- RDMA/irdma: Fix SD index calculation (git-fixes)\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes)\n- Revert \"drm/tegra: dsi: Clear enable register if powered by bootloader\" (git-fixes).\n- Revert \"wifi: ath10k: avoid unnecessary wait for service ready message\" (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes).\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2026-01-07T12:33:45Z","modified":"2026-03-23T04:52:31.109155Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20059-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: net: dst_cache: annotate data-races around dst_cache-\u003ereset_ts (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n- CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes)\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes)\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes)\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes)\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes)\n- RDMA/irdma: Fix SD index calculation (git-fixes)\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes)\n- Revert \"drm/tegra: dsi: Clear enable register if powered by bootloader\" (git-fixes).\n- Revert \"wifi: ath10k: avoid unnecessary wait for service ready message\" (git-fixes).\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes).\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2026-01-07T10:55:44Z","modified":"2026-03-23T04:52:33.099373Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20473-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Do not leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n- CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1253393).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes)\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes)\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes)\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes)\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes)\n- RDMA/irdma: Fix SD index calculation (git-fixes)\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes)\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2026-02-19T16:55:02Z","modified":"2026-03-23T04:51:38.764552Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20496-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-50253: bpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device (bsc#1249912).\n- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).\n- CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).\n- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).\n- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).\n- CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).\n- CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).\n- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).\n- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).\n- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).\n- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).\n- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).\n- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).\n- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).\n- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).\n- CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).\n- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).\n- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).\n- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).\n- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).\n- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).\n- CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).\n- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).\n- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).\n- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).\n- CVE-2025-40105: vfs: Do not leak disconnected dentries on umount (bsc#1252928).\n- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).\n- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).\n- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).\n- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).\n- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).\n- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).\n- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).\n- CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1253393).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).\n- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).\n- ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).\n- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).\n- ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).\n- ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).\n- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).\n- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).\n- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes).\n- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes).\n- ALSA: serial-generic: remove shared static buffer (stable-fixes).\n- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes).\n- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes).\n- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes).\n- ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes).\n- ALSA: usb-audio: do not log messages meant for 1810c when initializing 1824c (git-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes).\n- ASoC: cs4271: Fix regulator leak on probe failure (git-fixes).\n- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes).\n- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes).\n- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes).\n- ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes).\n- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes).\n- Bluetooth: 6lowpan: Do not hold spin lock over sleeping functions (git-fixes).\n- Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes).\n- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes).\n- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes).\n- Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes).\n- Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes).\n- Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes).\n- Bluetooth: bcsp: receive data only if registered (stable-fixes).\n- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes).\n- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes).\n- Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes).\n- Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes).\n- Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes).\n- HID: amd_sfh: Stop sensor before starting (git-fixes).\n- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes).\n- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes).\n- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes).\n- HID: uclogic: Fix potential memory leak in error path (git-fixes).\n- Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes).\n- Input: imx_sc_key - fix memory corruption on unload (git-fixes).\n- Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes).\n- KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).\n- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).\n- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes).\n- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).\n- KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes).\n- KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes).\n- KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes).\n- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes).\n- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).\n- KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes).\n- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes).\n- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes).\n- KVM: nVMX: Check vmcs12-\u003eguest_ia32_debugctl on nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).\n- KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes).\n- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).\n- KVM: x86: Do not treat ENTER and LEAVE as branches, because they are not (git-fixes).\n- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes).\n- NFS4: Fix state renewals missing after boot (git-fixes).\n- NFS: check if suid/sgid was cleared after a write as needed (git-fixes).\n- NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes).\n- NFSD: Skip close replay processing if XDR encoding fails (git-fixes).\n- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes).\n- NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes).\n- NFSv4: handle ERR_GRACE on delegation recalls (git-fixes).\n- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes).\n- PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes).\n- PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes).\n- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes).\n- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes).\n- PCI: j721e: Fix incorrect error message in probe() (git-fixes).\n- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).\n- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).\n- RDMA/bnxt_re: Do not fail destroy QP and cleanup debugfs earlier (git-fixes)\n- RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes)\n- RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes)\n- RDMA/hns: Fix the modification of max_send_sge (git-fixes)\n- RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes)\n- RDMA/irdma: Fix SD index calculation (git-fixes)\n- RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes)\n- accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes).\n- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes).\n- accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes).\n- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes).\n- acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes).\n- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes).\n- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes).\n- block: fix kobject double initialization in add_disk (git-fixes).\n- btrfs: abort transaction on failure to add link to inode (git-fixes).\n- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix).\n- btrfs: avoid using fixed char array size for tree names (git-fix).\n- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).\n- btrfs: fix COW handling in run_delalloc_nocow() (git-fix).\n- btrfs: fix inode leak on failure to add link to inode (git-fixes).\n- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix).\n- btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes).\n- btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix).\n- btrfs: rename err to ret in btrfs_link() (git-fixes).\n- btrfs: run btrfs_error_commit_super() early (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix).\n- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes).\n- btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes).\n- btrfs: simplify error handling logic for btrfs_link() (git-fixes).\n- btrfs: tree-checker: add dev extent item checks (git-fix).\n- btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix).\n- btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix).\n- btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix).\n- btrfs: tree-checker: validate dref root and objectid (git-fix).\n- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes).\n- char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes).\n- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes).\n- char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes).\n- cramfs: Verify inode mode when loading from disk (git-fixes).\n- crypto: aspeed - fix double free caused by devm (git-fixes).\n- crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes).\n- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes).\n- crypto: iaa - Do not clobber req-\u003ebase.data (git-fixes).\n- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes).\n- dmaengine: dw-edma: Set status for callback_result (stable-fixes).\n- dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes).\n- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).\n- drm/amd/display: Disable VRR on DCE 6 (stable-fixes).\n- drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes).\n- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes).\n- drm/amd/display: Fix black screen with HDMI outputs (git-fixes).\n- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes).\n- drm/amd/display: add more cyan skillfish devices (stable-fixes).\n- drm/amd/display: ensure committing streams is seamless (stable-fixes).\n- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).\n- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes).\n- drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes).\n- drm/amd/pm: Use cached metrics data on arcturus (stable-fixes).\n- drm/amd: Avoid evicting resources at S5 (stable-fixes).\n- drm/amd: Fix suspend failure with secure display TA (git-fixes).\n- drm/amd: add more cyan skillfish PCI ids (stable-fixes).\n- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes).\n- drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes).\n- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes).\n- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes).\n- drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes).\n- drm/amdgpu: do not enable SMU on cyan skillfish (stable-fixes).\n- drm/amdgpu: reject gang submissions under SRIOV (stable-fixes).\n- drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes).\n- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes).\n- drm/amdkfd: fix vram allocation failure for a special case (stable-fixes).\n- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes).\n- drm/bridge: cdns-dsi: Do not fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes).\n- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes).\n- drm/bridge: display-connector: do not set OP_DETECT for DisplayPorts (stable-fixes).\n- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes).\n- drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes).\n- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes).\n- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes).\n- drm/msm: make sure to not queue up recovery more than once (stable-fixes).\n- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes).\n- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes).\n- drm/tegra: Add call to put_pid() (git-fixes).\n- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes).\n- drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes).\n- drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes).\n- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes).\n- exfat: limit log print for IO error (git-fixes).\n- extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes).\n- extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes).\n- fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released (stable-fixes).\n- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes).\n- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes).\n- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes).\n- hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes).\n- hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes).\n- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes).\n- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes).\n- hwmon: sy7636a: add alias (stable-fixes).\n- iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes).\n- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes).\n- ima: do not clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes).\n- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes).\n- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes).\n- jfs: Verify inode mode when loading from disk (git-fixes).\n- jfs: fix uninitialized waitqueue in transaction manager (git-fixes).\n- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes).\n- md/raid1: fix data lost for writemostly rdev (git-fixes).\n- md: fix mssing blktrace bio split events (git-fixes).\n- media: adv7180: Add missing lock in suspend callback (stable-fixes).\n- media: adv7180: Do not write format to device in set_fmt (stable-fixes).\n- media: adv7180: Only validate format in querystd (stable-fixes).\n- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).\n- media: fix uninitialized symbol warnings (stable-fixes).\n- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes).\n- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes).\n- media: imon: make send_packet() more robust (stable-fixes).\n- media: ov08x40: Fix the horizontal flip control (stable-fixes).\n- media: redrat3: use int type to store negative error codes (stable-fixes).\n- media: uvcvideo: Use heuristic to find stream entity (git-fixes).\n- memstick: Add timeout to prevent indefinite waiting (stable-fixes).\n- mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes).\n- mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes).\n- mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes).\n- mfd: stmpe: Remove IRQ domain upon removal (stable-fixes).\n- minixfs: Verify inode mode when loading from disk (git-fixes).\n- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes).\n- mm/secretmem: fix use-after-free race in fault handler (git-fixes).\n- mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes).\n- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes).\n- mtd: onenand: Pass correct pointer to IRQ handler (git-fixes).\n- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes).\n- mtdchar: fix integer overflow in read/write ioctls (git-fixes).\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779).\n- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes).\n- net: phy: clear link parameters on admin link down (stable-fixes).\n- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes).\n- net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes).\n- net: tcp: send zero-window ACK when no memory (bsc#1253779).\n- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes).\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes).\n- perf script: add --addr2line option (bsc#1247509).\n- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes).\n- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes).\n- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes).\n- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes).\n- pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes).\n- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes).\n- power: supply: qcom_battmgr: add OOI chemistry (stable-fixes).\n- power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes).\n- power: supply: sbs-charger: Support multiple devices (stable-fixes).\n- regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes).\n- rtc: rx8025: fix incorrect register reference (git-fixes).\n- s390/mm,fault: simplify kfence fault handling (bsc#1247076).\n- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes).\n- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes).\n- scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes).\n- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes).\n- scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes).\n- scsi: mpi3mr: Correctly handle ATA device errors (git-fixes).\n- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes).\n- scsi: mpt3sas: Correctly handle ATA device errors (git-fixes).\n- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes).\n- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes).\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes).\n- selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes).\n- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes).\n- selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes).\n- selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes).\n- selftests/bpf: Fix string read in strncmp benchmark (git-fixes).\n- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes).\n- selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes).\n- selftests/bpf: fix signedness bug in redir_partial() (git-fixes).\n- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes).\n- serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes).\n- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes).\n- soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes).\n- soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes).\n- spi: Try to get ACPI GPIO IRQ earlier (git-fixes).\n- spi: loopback-test: Do not use %pK through printk (stable-fixes).\n- spi: rpc-if: Add resume support for RZ/G3E (stable-fixes).\n- strparser: Fix signed/unsigned mismatch bug (git-fixes).\n- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-\u003ecork (bsc#1250705).\n- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes).\n- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes).\n- tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes).\n- tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes).\n- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes).\n- tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes).\n- tools: lib: thermal: do not preserve owner in install (stable-fixes).\n- tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes).\n- uio_hv_generic: Query the ringbuffer size for device (git-fixes).\n- usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes).\n- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes).\n- usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes).\n- usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes).\n- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes).\n- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes).\n- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes).\n- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes).\n- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes).\n- wifi: ath10k: Fix connection after GTK rekeying (stable-fixes).\n- wifi: ath11k: zero init info-\u003estatus in wmi_process_mgmt_tx_comp() (git-fixes).\n- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes).\n- wifi: mac80211: Fix HE capabilities element check (stable-fixes).\n- wifi: mac80211: reject address change while connecting (git-fixes).\n- wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes).\n- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes).\n- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes).\n- wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes).\n- wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes).\n- wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes).\n- wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes).\n- x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes).\n- x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes).\n- x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes).\n- x86/CPU/AMD: Do the common init on future Zens too (git-fixes).\n- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes).\n- x86/bugs: Fix reporting of LFENCE retpoline (git-fixes).\n- x86/bugs: Report correct retbleed mitigation status (git-fixes).\n- x86/vmscape: Add old Intel CPUs to affected list (git-fixes).\n- xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes).\n- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes).\n- xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes).\n- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes).\n- xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes).\n","status":"published","published":"2026-02-19T15:57:41Z","modified":"2026-03-23T04:52:59.914226Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:3593-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-4994: KVM: x86: wean fast IN from emulator_pio_in (bsc#1273097).\n- CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).\n- CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).\n- CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).\n- CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len (bsc#1267715).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).\n- CVE-2026-53260: preempt: Provide preempt_[dis|en]able_nested() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). \n- CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: recompute network header pointer once (bsc#1272855).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- mkspec-dtb: Skip missing DTBs.\n- pkspec-dtb: Fix dtb-al rename.\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- sctp: validate embedded address parameter length (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n","status":"published","published":"2026-08-12T11:30:20Z","modified":"2026-08-13T09:30:08.205798891Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3595-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-4994: KVM: x86: wean fast IN from emulator_pio_in (bsc#1273097).\n- CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).\n- CVE-2024-38542: RDMA/mana_ib: boundary check before installing cq callbacks (bsc#1226591).\n- CVE-2025-21953: net: mana: cleanup mana struct after debugfs_remove() (bsc#1240727).\n- CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).\n- CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).\n- CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len (bsc#1267715).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).\n- CVE-2026-53260: preempt: Provide preempt_[dis|en]able_nested() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63884: drm/i915: Fix potential UAF in TTM object purge (bsc#1272573).\n- CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: recompute network header pointer once (bsc#1272855).\n- CVE-2026-63946: Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1272665).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- block: fix use-after-free of q-\u003eq_usage_counter (bsc#1268750).\n- cpumask: add cpumask_weight_andnot() (bsc#1239015).\n- Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes).\n- Drivers: hv: remove stale comment (git-fixes).\n- Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes).\n- Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes).\n- Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- Drivers: hv: vmbus: Remove duplication and cleanup code in create_gpadl_header() (git-fixes).\n- Drivers: hv: vmbus: Update indentation in create_gpadl_header() (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- ethtool: Implement ethtool_puts() (git-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: Use VF's tso_max_size value when data path is VF (bsc#1246203).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_utils: Allow implicit ICTIMESYNCFLAG_SYNC (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- IPv6/GRO: generic helper to remove temporary HBH/jumbo header in (bsc#1246203).\n- ipv6/gso: remove temporary HBH/jumbo header (bsc#1246203).\n- ipv6: add struct hop_jumbo_hdr definition (bsc#1246203).\n- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (bsc#1257466).\n- jiffies: Define secs_to_jiffies() (bsc#1257466).\n- lib/bitmap: add bitmap_weight_and() (bsc#1239015).\n- mkspec-dtb: Skip missing DTBs.\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/mana: Null service_wq on setup error to prevent double destroy (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net: mana: add a function to spread IRQs per CPUs (bsc#1239015).\n- net: mana: Add debug logs in MANA network driver (bsc#1246212).\n- net: mana: Add handler for hardware servicing events (bsc#1245730 bsc#1251971).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: Add metadata support for xdp mode (git-fixes).\n- net: mana: add msix index sharing between EQs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Add standard counter rx_missed_errors (git-fixes).\n- net: mana: Add support for auxiliary device servicing events (bsc#1251971).\n- net: mana: Add support for Multi Vports on Bare metal (bsc#1244229).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Allow irq_setup() to skip cpus for affinity (bsc#1245457).\n- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (bsc#1246203).\n- net: mana: Assigning IRQ affinity on HT cores (bsc#1239015).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).\n- net: mana: explain irq_setup() algorithm (bsc#1245457).\n- net: mana: Expose additional hardware counters for drop and TC via ethtool (bsc#1245729).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (git-fixes).\n- net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs (bsc#1239015).\n- net: mana: Fix memory leak in mana_gd_setup_irqs (bsc#1239015).\n- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).\n- net: mana: Fix spelling mistake 'enforecement' -\u003e 'enforcement' (git-fixes).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: fix use-after-free in add_adev() error path (git-fixes).\n- net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes).\n- net: mana: Fix use-after-free in reset service rescan path (git-fixes).\n- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (bsc#1269798).\n- net: mana: Handle hardware recovery events when probing the device (bsc#1257466).\n- net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971).\n- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).\n- net: mana: Handle unsupported HWC commands (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (bsc#1269798).\n- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).\n- net: mana: Probe rdma device in mana driver (git-fixes).\n- net: mana: Record doorbell physical address in PF mode (bsc#1244229).\n- net: mana: Reduce waiting time if HWC not responding (bsc#1252266).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Set tx_packets to post gso processing packet count (bsc#1245731).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Support HW link state events (bsc#1253049).\n- net: mana: Switch to page pool for jumbo frames (git-fixes).\n- net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: use ethtool string helpers (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- PCI: hv: Correct a comment (git-fixes).\n- PCI: hv: Fix ring buffer size calculation (git-fixes).\n- PCI: hv: remove unnecessary module_init/exit functions (git-fixes).\n- PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- pkspec-dtb: Fix dtb-al rename.\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135).\n- RDMA/mana_ib: add additional port counters (bsc#1251135).\n- RDMA/mana_ib: Add CQ interrupt support for RAW QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add device statistics support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add device-memory support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add EQ creation for rnic adapter (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add port statistics support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: add support of multiple ports (bsc#1251135).\n- RDMA/mana_ib: Adding and deleting GIDs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Allocate PAGE aligned doorbell index (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: check cqe length for kernel CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Configure mac address in RNIC (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Create and destroy RC QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Create and destroy rnic adapter (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create and destroy RNIC cqs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Create and destroy UD/GSI QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create EQs for RNIC CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create kernel-level CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create/destroy AH (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Drain send wrs of GSI QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Enable RoCE on port 1 (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Ensure variable err is initialized (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: extend mana QP table (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Extend modify QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: extend query device (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Fix DSCP value in modify QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Fix error code in probe() (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135).\n- RDMA/mana_ib: Fix missing ret value (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).\n- RDMA/mana_ib: helpers to allocate kernel queues (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Implement DMABUF MR support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: implement get_dma_mr (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Implement port parameters (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: implement req_notify_cq (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: implement uapi for creation of rnic cq (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Implement uapi to create and destroy RC QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: indicate CM support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- RDMA/mana_ib: introduce a helper to remove cq callbacks (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce helpers to create and destroy mana queues (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce mdev_to_gc helper function (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Modify QP state (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: polling of CQs for GSI/UD (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Process QP error events in mana_ib (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: query device capabilities (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Query feature_flags bitmask from FW (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: register RDMA device with GDMA (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: remove useless return values from dbg prints (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- RDMA/mana_ib: request error CQEs when supported (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Set correct device into ib (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: set node_guid (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Support memory windows (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: support of the zero based MRs (bsc#1251135).\n- RDMA/mana_ib: Take CQ type from the device type (bsc#1257541).\n- RDMA/mana_ib: UD/GSI QP creation for kernel (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: UD/GSI work requests (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: unify mana_ib functions to support any gdma device (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (bsc#1271011 jsc#PED-16573).\n- RDMA/mana_ib: Use num_comp_vectors of ib_device (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use safer allocation function() (bsc#1251135).\n- RDMA/mana_ib: Use struct mana_ib_queue for CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use struct mana_ib_queue for WQs (bsc#1240552 jsc#PED-12576).\n- sched/topology: Introduce for_each_numa_hop_mask() (bsc#1239015).\n- sched/topology: Introduce sched_numa_hop_mask() (bsc#1239015).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: storvsc: Remove redundant ternary operators (git-fixes).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- tcp: gso: really support BIG TCP (bsc#1246203).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n","status":"published","published":"2026-09-09T12:14:50Z","modified":"2026-09-09T18:12:28.206436321Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3616-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-4994: KVM: x86: wean fast IN from emulator_pio_in (bsc#1273097).\n- CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).\n- CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).\n- CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).\n- CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len (bsc#1267715).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).\n- CVE-2026-53260: preempt: Provide preempt_[dis|en]able_nested() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- mkspec-dtb: Skip missing DTBs.\n- pkspec-dtb: Fix dtb-al rename.\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- sctp: validate embedded address parameter length (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n","status":"published","published":"2026-08-13T18:03:59Z","modified":"2026-08-14T18:15:08.222736903Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3617-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-4994: KVM: x86: wean fast IN from emulator_pio_in (bsc#1273097).\n- CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).\n- CVE-2024-38542: RDMA/mana_ib: boundary check before installing cq callbacks (bsc#1226591).\n- CVE-2025-21953: net: mana: cleanup mana struct after debugfs_remove() (bsc#1240727).\n- CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).\n- CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).\n- CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len (bsc#1267715).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).\n- CVE-2026-53260: preempt: Provide preempt_[dis|en]able_nested() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63884: drm/i915: Fix potential UAF in TTM object purge (bsc#1272573).\n- CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63946: Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1272665).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- block: fix use-after-free of q-\u003eq_usage_counter (bsc#1268750).\n- cpumask: add cpumask_weight_andnot() (bsc#1239015).\n- Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes).\n- Drivers: hv: remove stale comment (git-fixes).\n- Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes).\n- Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes).\n- Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- Drivers: hv: vmbus: Remove duplication and cleanup code in create_gpadl_header() (git-fixes).\n- Drivers: hv: vmbus: Update indentation in create_gpadl_header() (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- ethtool: Implement ethtool_puts() (git-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: Use VF's tso_max_size value when data path is VF (bsc#1246203).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_utils: Allow implicit ICTIMESYNCFLAG_SYNC (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- IPv6/GRO: generic helper to remove temporary HBH/jumbo header in (bsc#1246203).\n- ipv6/gso: remove temporary HBH/jumbo header (bsc#1246203).\n- ipv6: add struct hop_jumbo_hdr definition (bsc#1246203).\n- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (bsc#1257466).\n- jiffies: Define secs_to_jiffies() (bsc#1257466).\n- lib/bitmap: add bitmap_weight_and() (bsc#1239015).\n- mkspec-dtb: Skip missing DTBs.\n- net/mana: fix warning in the writer of client oob (git-fixes).\n- net/mana: Null service_wq on setup error to prevent double destroy (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net: mana: add a function to spread IRQs per CPUs (bsc#1239015).\n- net: mana: Add debug logs in MANA network driver (bsc#1246212).\n- net: mana: Add handler for hardware servicing events (bsc#1245730 bsc#1251971).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: Add metadata support for xdp mode (git-fixes).\n- net: mana: add msix index sharing between EQs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Add standard counter rx_missed_errors (git-fixes).\n- net: mana: Add support for auxiliary device servicing events (bsc#1251971).\n- net: mana: Add support for Multi Vports on Bare metal (bsc#1244229).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Allow irq_setup() to skip cpus for affinity (bsc#1245457).\n- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (bsc#1246203).\n- net: mana: Assigning IRQ affinity on HT cores (bsc#1239015).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).\n- net: mana: explain irq_setup() algorithm (bsc#1245457).\n- net: mana: Expose additional hardware counters for drop and TC via ethtool (bsc#1245729).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (git-fixes).\n- net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs (bsc#1239015).\n- net: mana: Fix memory leak in mana_gd_setup_irqs (bsc#1239015).\n- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).\n- net: mana: Fix spelling mistake 'enforecement' -\u003e 'enforcement' (git-fixes).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: fix use-after-free in add_adev() error path (git-fixes).\n- net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes).\n- net: mana: Fix use-after-free in reset service rescan path (git-fixes).\n- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (bsc#1269798).\n- net: mana: Handle hardware recovery events when probing the device (bsc#1257466).\n- net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971).\n- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).\n- net: mana: Handle unsupported HWC commands (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (bsc#1269798).\n- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).\n- net: mana: Probe rdma device in mana driver (git-fixes).\n- net: mana: Record doorbell physical address in PF mode (bsc#1244229).\n- net: mana: Reduce waiting time if HWC not responding (bsc#1252266).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Set tx_packets to post gso processing packet count (bsc#1245731).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Support HW link state events (bsc#1253049).\n- net: mana: Switch to page pool for jumbo frames (git-fixes).\n- net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: use ethtool string helpers (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- PCI: hv: Correct a comment (git-fixes).\n- PCI: hv: Fix ring buffer size calculation (git-fixes).\n- PCI: hv: remove unnecessary module_init/exit functions (git-fixes).\n- PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- pkspec-dtb: Fix dtb-al rename.\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135).\n- RDMA/mana_ib: add additional port counters (bsc#1251135).\n- RDMA/mana_ib: Add CQ interrupt support for RAW QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add device statistics support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add device-memory support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add EQ creation for rnic adapter (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add port statistics support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: add support of multiple ports (bsc#1251135).\n- RDMA/mana_ib: Adding and deleting GIDs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Allocate PAGE aligned doorbell index (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: check cqe length for kernel CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Configure mac address in RNIC (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Create and destroy RC QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Create and destroy rnic adapter (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create and destroy RNIC cqs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Create and destroy UD/GSI QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create EQs for RNIC CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create kernel-level CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: create/destroy AH (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Drain send wrs of GSI QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Enable RoCE on port 1 (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Ensure variable err is initialized (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: extend mana QP table (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Extend modify QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: extend query device (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Fix DSCP value in modify QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Fix error code in probe() (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135).\n- RDMA/mana_ib: Fix missing ret value (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).\n- RDMA/mana_ib: helpers to allocate kernel queues (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Implement DMABUF MR support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: implement get_dma_mr (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Implement port parameters (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: implement req_notify_cq (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: implement uapi for creation of rnic cq (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Implement uapi to create and destroy RC QP (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: indicate CM support (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- RDMA/mana_ib: introduce a helper to remove cq callbacks (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce helpers to create and destroy mana queues (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Introduce mdev_to_gc helper function (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Modify QP state (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: polling of CQs for GSI/UD (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Process QP error events in mana_ib (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: query device capabilities (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Query feature_flags bitmask from FW (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: register RDMA device with GDMA (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: remove useless return values from dbg prints (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- RDMA/mana_ib: request error CQEs when supported (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Set correct device into ib (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: set node_guid (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Support memory windows (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: support of the zero based MRs (bsc#1251135).\n- RDMA/mana_ib: Take CQ type from the device type (bsc#1257541).\n- RDMA/mana_ib: UD/GSI QP creation for kernel (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: UD/GSI work requests (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: unify mana_ib functions to support any gdma device (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (bsc#1271011 jsc#PED-16573).\n- RDMA/mana_ib: Use num_comp_vectors of ib_device (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use safer allocation function() (bsc#1251135).\n- RDMA/mana_ib: Use struct mana_ib_queue for CQs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (bsc#1240552 jsc#PED-12576).\n- RDMA/mana_ib: Use struct mana_ib_queue for WQs (bsc#1240552 jsc#PED-12576).\n- sched/topology: Introduce for_each_numa_hop_mask() (bsc#1239015).\n- sched/topology: Introduce sched_numa_hop_mask() (bsc#1239015).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: storvsc: Remove redundant ternary operators (git-fixes).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- tcp: gso: really support BIG TCP (bsc#1246203).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n","status":"published","published":"2026-08-13T18:04:38Z","modified":"2026-08-14T18:15:08.225259322Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-7521-1","title":"linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - FireWire subsystem;\n  - EFI core;\n  - Qualcomm firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I2C subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Framebuffer layer;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - Overlay file system;\n  - SMB network file system;\n  - UBI file system;\n  - BPF subsystem;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - L3 Master device support module;\n  - TCP network protocol;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - Process Accounting mechanism;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Scheduler infrastructure;\n  - Workqueue subsystem;\n  - Memory management;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Wireless networking;\n  - Key management;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n  - SOF drivers;\n(CVE-2025-21737, CVE-2025-21711, CVE-2025-21987, CVE-2025-21848,\nCVE-2024-49570, CVE-2025-21762, CVE-2025-21738, CVE-2025-21712,\nCVE-2025-21719, CVE-2025-21870, CVE-2024-57984, CVE-2025-21815,\nCVE-2025-21744, CVE-2024-58058, CVE-2024-58078, CVE-2024-57990,\nCVE-2024-54458, CVE-2025-21899, CVE-2025-21814, CVE-2025-21746,\nCVE-2024-54456, CVE-2025-21739, CVE-2024-58057, CVE-2025-21855,\nCVE-2025-21758, CVE-2024-58006, CVE-2024-58007, CVE-2025-21720,\nCVE-2024-58090, CVE-2025-21852, CVE-2024-57982, CVE-2024-58013,\nCVE-2024-58082, CVE-2025-21825, CVE-2024-58072, CVE-2024-57996,\nCVE-2025-21787, CVE-2025-21742, CVE-2025-21705, CVE-2025-21829,\nCVE-2024-58060, CVE-2025-21811, CVE-2025-21900, CVE-2025-21853,\nCVE-2025-21809, CVE-2025-21938, CVE-2025-21728, CVE-2025-21785,\nCVE-2025-21732, CVE-2025-21888, CVE-2025-21768, CVE-2025-21875,\nCVE-2025-21721, CVE-2025-21766, CVE-2025-21892, CVE-2024-57953,\nCVE-2025-21772, CVE-2025-21735, CVE-2024-58017, CVE-2024-58086,\nCVE-2024-58084, CVE-2025-21761, CVE-2024-58008, CVE-2024-57988,\nCVE-2025-21874, CVE-2024-58011, CVE-2025-21706, CVE-2024-57999,\nCVE-2025-21858, CVE-2024-58061, CVE-2025-21727, CVE-2025-21780,\nCVE-2024-58051, CVE-2025-21791, CVE-2025-21788, CVE-2025-21786,\nCVE-2024-58012, CVE-2024-58010, CVE-2024-58001, CVE-2025-21844,\nCVE-2025-21708, CVE-2024-57834, CVE-2025-21873, CVE-2025-21704,\nCVE-2025-21765, CVE-2025-21839, CVE-2025-21723, CVE-2024-57974,\nCVE-2025-21876, CVE-2025-21782, CVE-2025-21866, CVE-2024-58076,\nCVE-2025-21724, CVE-2025-21895, CVE-2025-21770, CVE-2025-21835,\nCVE-2024-58052, CVE-2025-21827, CVE-2024-58069, CVE-2025-21828,\nCVE-2025-21734, CVE-2025-21781, CVE-2025-21971, CVE-2025-21775,\nCVE-2024-52559, CVE-2024-58020, CVE-2025-21713, CVE-2024-58068,\nCVE-2024-58018, CVE-2025-21806, CVE-2025-21802, CVE-2025-21731,\nCVE-2025-21741, CVE-2025-21847, CVE-2025-21767, CVE-2024-58003,\nCVE-2024-57993, CVE-2025-21725, CVE-2025-21796, CVE-2025-21764,\nCVE-2025-21862, CVE-2025-21733, CVE-2024-58075, CVE-2025-21808,\nCVE-2024-58034, CVE-2025-21707, CVE-2024-58080, CVE-2025-21784,\nCVE-2024-57994, CVE-2025-21890, CVE-2025-21754, CVE-2024-58063,\nCVE-2025-21826, CVE-2025-21821, CVE-2024-58079, CVE-2024-58056,\nCVE-2025-21798, CVE-2024-58077, CVE-2024-58019, CVE-2025-21748,\nCVE-2025-21759, CVE-2024-58004, CVE-2024-58081, CVE-2024-57978,\nCVE-2025-21865, CVE-2024-58002, CVE-2025-21810, CVE-2025-21743,\nCVE-2024-57989, CVE-2025-21718, CVE-2024-57987, CVE-2025-21877,\nCVE-2024-57973, CVE-2024-58070, CVE-2024-58071, CVE-2025-21891,\nCVE-2024-58021, CVE-2024-58016, CVE-2024-58005, CVE-2025-21760,\nCVE-2025-21883, CVE-2025-21878, CVE-2025-21881, CVE-2025-21838,\nCVE-2025-21783, CVE-2024-57986, CVE-2025-21793, CVE-2025-21859,\nCVE-2025-21792, CVE-2025-21820, CVE-2025-21799, CVE-2025-21750,\nCVE-2025-21795, CVE-2025-21854, CVE-2025-21836, CVE-2025-21726,\nCVE-2025-21846, CVE-2025-21864, CVE-2024-57977, CVE-2025-21887,\nCVE-2025-21710, CVE-2025-21889, CVE-2025-21812, CVE-2025-21773,\nCVE-2024-57852, CVE-2025-21856, CVE-2025-21871, CVE-2025-21763,\nCVE-2024-58064, CVE-2025-21804, CVE-2024-58055, CVE-2025-21898,\nCVE-2025-21776, CVE-2025-21869, CVE-2025-21745, CVE-2025-21736,\nCVE-2025-21716, CVE-2024-57981, CVE-2024-57979, CVE-2025-21715,\nCVE-2024-57998, CVE-2025-21790, CVE-2024-58085, CVE-2025-21749,\nCVE-2024-58088, CVE-2025-21753, CVE-2025-21851, CVE-2024-58054,\nCVE-2025-21830, CVE-2025-21832, CVE-2024-57980, CVE-2025-21885,\nCVE-2025-21863, CVE-2024-58053, CVE-2025-21823, CVE-2025-21857,\nCVE-2024-58083, CVE-2024-58014, CVE-2025-21816, CVE-2025-21779,\nCVE-2025-21872, CVE-2024-57997, CVE-2025-21867, CVE-2024-57985,\nCVE-2025-21831, CVE-2025-21801, CVE-2025-21868, CVE-2025-21849)\n","status":"published","published":"2025-05-20T14:01:07Z","modified":"2026-10-30T21:55:24.19559818Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7521-3","title":"linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - FireWire subsystem;\n  - EFI core;\n  - Qualcomm firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I2C subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Framebuffer layer;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - Overlay file system;\n  - SMB network file system;\n  - UBI file system;\n  - BPF subsystem;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - L3 Master device support module;\n  - TCP network protocol;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - Process Accounting mechanism;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Scheduler infrastructure;\n  - Workqueue subsystem;\n  - Memory management;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Wireless networking;\n  - Key management;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n  - SOF drivers;\n(CVE-2025-21799, CVE-2025-21765, CVE-2024-57834, CVE-2025-21971,\nCVE-2025-21855, CVE-2024-58019, CVE-2025-21987, CVE-2025-21754,\nCVE-2025-21779, CVE-2024-57986, CVE-2025-21809, CVE-2025-21887,\nCVE-2025-21744, CVE-2024-58014, CVE-2025-21892, CVE-2025-21848,\nCVE-2024-58051, CVE-2024-58085, CVE-2025-21862, CVE-2024-57981,\nCVE-2024-57987, CVE-2024-58053, CVE-2024-58063, CVE-2024-58079,\nCVE-2025-21875, CVE-2025-21715, CVE-2024-58004, CVE-2025-21857,\nCVE-2025-21856, CVE-2025-21938, CVE-2024-58082, CVE-2025-21815,\nCVE-2025-21864, CVE-2024-52559, CVE-2024-58078, CVE-2024-57989,\nCVE-2024-58001, CVE-2025-21889, CVE-2025-21739, CVE-2024-58005,\nCVE-2025-21829, CVE-2024-58069, CVE-2025-21712, CVE-2025-21846,\nCVE-2025-21883, CVE-2025-21852, CVE-2025-21808, CVE-2025-21900,\nCVE-2025-21888, CVE-2025-21784, CVE-2025-21838, CVE-2024-58054,\nCVE-2025-21781, CVE-2025-21737, CVE-2024-58013, CVE-2025-21885,\nCVE-2025-21877, CVE-2024-58010, CVE-2025-21844, CVE-2024-58012,\nCVE-2024-58083, CVE-2025-21783, CVE-2025-21798, CVE-2024-57973,\nCVE-2024-57982, CVE-2025-21708, CVE-2024-58003, CVE-2025-21786,\nCVE-2025-21750, CVE-2025-21870, CVE-2025-21745, CVE-2024-58081,\nCVE-2024-57979, CVE-2025-21718, CVE-2025-21816, CVE-2025-21868,\nCVE-2025-21731, CVE-2025-21814, CVE-2025-21826, CVE-2024-58006,\nCVE-2025-21821, CVE-2024-57852, CVE-2025-21746, CVE-2025-21874,\nCVE-2025-21866, CVE-2025-21770, CVE-2025-21899, CVE-2025-21804,\nCVE-2025-21723, CVE-2025-21742, CVE-2024-57988, CVE-2024-58034,\nCVE-2025-21733, CVE-2024-57980, CVE-2025-21782, CVE-2025-21711,\nCVE-2024-58090, CVE-2025-21761, CVE-2025-21851, CVE-2025-21828,\nCVE-2024-58068, CVE-2024-58018, CVE-2024-58064, CVE-2025-21869,\nCVE-2025-21772, CVE-2025-21758, CVE-2025-21793, CVE-2024-58017,\nCVE-2025-21835, CVE-2025-21775, CVE-2025-21719, CVE-2024-57998,\nCVE-2024-58002, CVE-2024-57993, CVE-2025-21847, CVE-2025-21760,\nCVE-2025-21796, CVE-2024-58075, CVE-2024-58077, CVE-2025-21773,\nCVE-2025-21790, CVE-2025-21872, CVE-2025-21895, CVE-2025-21732,\nCVE-2025-21871, CVE-2024-58058, CVE-2025-21749, CVE-2025-21830,\nCVE-2025-21704, CVE-2025-21720, CVE-2025-21748, CVE-2025-21726,\nCVE-2025-21801, CVE-2024-58076, CVE-2025-21881, CVE-2025-21831,\nCVE-2025-21724, CVE-2024-58086, CVE-2025-21812, CVE-2024-57985,\nCVE-2025-21795, CVE-2025-21725, CVE-2025-21762, CVE-2025-21788,\nCVE-2024-58080, CVE-2025-21839, CVE-2024-58057, CVE-2025-21706,\nCVE-2024-58011, CVE-2025-21832, CVE-2024-58061, CVE-2025-21710,\nCVE-2025-21734, CVE-2025-21836, CVE-2024-54456, CVE-2024-58008,\nCVE-2025-21743, CVE-2024-58071, CVE-2025-21707, CVE-2025-21791,\nCVE-2025-21767, CVE-2024-57974, CVE-2024-58021, CVE-2025-21849,\nCVE-2025-21827, CVE-2024-58084, CVE-2024-58016, CVE-2024-58072,\nCVE-2025-21802, CVE-2024-58055, CVE-2025-21853, CVE-2024-57997,\nCVE-2025-21858, CVE-2024-57999, CVE-2025-21780, CVE-2025-21876,\nCVE-2024-58088, CVE-2025-21820, CVE-2025-21753, CVE-2025-21766,\nCVE-2025-21768, CVE-2025-21898, CVE-2025-21785, CVE-2024-54458,\nCVE-2024-58060, CVE-2024-49570, CVE-2025-21759, CVE-2024-57953,\nCVE-2024-57977, CVE-2025-21810, CVE-2025-21735, CVE-2025-21728,\nCVE-2025-21865, CVE-2024-58007, CVE-2025-21776, CVE-2025-21859,\nCVE-2025-21721, CVE-2025-21823, CVE-2024-58070, CVE-2024-57996,\nCVE-2024-58056, CVE-2024-58020, CVE-2025-21741, CVE-2025-21806,\nCVE-2025-21727, CVE-2025-21736, CVE-2025-21787, CVE-2025-21763,\nCVE-2025-21811, CVE-2025-21873, CVE-2025-21890, CVE-2024-58052,\nCVE-2025-21705, CVE-2025-21713, CVE-2025-21863, CVE-2025-21716,\nCVE-2025-21825, CVE-2025-21792, CVE-2025-21854, CVE-2025-21738,\nCVE-2024-57990, CVE-2024-57994, CVE-2024-57978, CVE-2025-21878,\nCVE-2025-21867, CVE-2025-21764, CVE-2024-57984, CVE-2025-21891)\n","status":"published","published":"2025-05-28T07:53:47Z","modified":"2026-10-30T21:55:07.727292649Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7651-1","title":"linux, linux-aws, linux-oem-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2024-57980, CVE-2024-58061, CVE-2025-21742, CVE-2025-21820,\nCVE-2024-57993, CVE-2024-58071, CVE-2024-58017, CVE-2024-58019,\nCVE-2025-21745, CVE-2024-58016, CVE-2024-58011, CVE-2024-58054,\nCVE-2025-21731, CVE-2024-58058, CVE-2024-58082, CVE-2025-21722,\nCVE-2024-58063, CVE-2024-58014, CVE-2025-21735, CVE-2025-21828,\nCVE-2025-21804, CVE-2024-58018, CVE-2025-21814, CVE-2024-58005,\nCVE-2024-58078, CVE-2025-21832, CVE-2025-21725, CVE-2025-21732,\nCVE-2025-21718, CVE-2024-58069, CVE-2024-58052, CVE-2024-57973,\nCVE-2025-21825, CVE-2024-58056, CVE-2024-58080, CVE-2025-21810,\nCVE-2024-57953, CVE-2025-37974, CVE-2024-57979, CVE-2025-21708,\nCVE-2024-57974, CVE-2025-21753, CVE-2025-21736, CVE-2025-21728,\nCVE-2025-21743, CVE-2025-21815, CVE-2025-21802, CVE-2025-21739,\nCVE-2024-57986, CVE-2024-57982, CVE-2025-21749, CVE-2025-21806,\nCVE-2025-21754, CVE-2025-21738, CVE-2025-21716, CVE-2025-21705,\nCVE-2024-57998, CVE-2024-58006, CVE-2024-58068, CVE-2025-21748,\nCVE-2024-58077, CVE-2025-21723, CVE-2024-58013, CVE-2025-21719,\nCVE-2024-58002, CVE-2025-21750, CVE-2024-58053, CVE-2024-58070,\nCVE-2025-21809, CVE-2024-57975, CVE-2025-21816, CVE-2025-21798,\nCVE-2024-58051, CVE-2024-58083, CVE-2025-21808, CVE-2025-21799,\nCVE-2024-57996, CVE-2024-58085, CVE-2025-21744, CVE-2024-57994,\nCVE-2024-58055, CVE-2024-58076, CVE-2025-21710, CVE-2025-21707,\nCVE-2024-58072, CVE-2025-21726, CVE-2025-21811, CVE-2025-37750,\nCVE-2024-58001, CVE-2025-21714, CVE-2025-21711, CVE-2025-21830,\nCVE-2024-58007, CVE-2025-21812, CVE-2025-21734, CVE-2024-58034,\nCVE-2024-58081, CVE-2024-58079, CVE-2024-58003, CVE-2025-21721,\nCVE-2024-49887, CVE-2024-57984, CVE-2025-21715, CVE-2025-21801,\nCVE-2024-57997, CVE-2025-21741, CVE-2025-21727, CVE-2024-58057,\nCVE-2025-21724, CVE-2024-57990, CVE-2024-57981, CVE-2024-57999,\nCVE-2025-21733, CVE-2025-21829, CVE-2024-58010, CVE-2025-21720,\nCVE-2025-21826)\n","status":"published","published":"2025-07-17T16:02:52Z","modified":"2026-10-30T21:55:06.579169859Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7651-2","title":"linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2024-57980, CVE-2024-57999, CVE-2025-21727, CVE-2024-58058,\nCVE-2024-58052, CVE-2025-21739, CVE-2025-21722, CVE-2024-58072,\nCVE-2025-21748, CVE-2024-57993, CVE-2024-58003, CVE-2024-58077,\nCVE-2025-21734, CVE-2024-58070, CVE-2025-21719, CVE-2024-58006,\nCVE-2025-21826, CVE-2024-58061, CVE-2025-21745, CVE-2025-21715,\nCVE-2024-58078, CVE-2025-21829, CVE-2024-49887, CVE-2025-21742,\nCVE-2025-21721, CVE-2025-21724, CVE-2025-21828, CVE-2025-21814,\nCVE-2025-21801, CVE-2024-57953, CVE-2024-58081, CVE-2024-58080,\nCVE-2025-21753, CVE-2025-21732, CVE-2025-21811, CVE-2025-37974,\nCVE-2024-58068, CVE-2024-58010, CVE-2024-58011, CVE-2024-58085,\nCVE-2025-21714, CVE-2025-21705, CVE-2025-21735, CVE-2024-58001,\nCVE-2024-58082, CVE-2024-58055, CVE-2025-21743, CVE-2025-21716,\nCVE-2024-57998, CVE-2025-21731, CVE-2024-58017, CVE-2024-58053,\nCVE-2025-21808, CVE-2024-57997, CVE-2024-58016, CVE-2024-58076,\nCVE-2025-21710, CVE-2025-21738, CVE-2025-21809, CVE-2025-21733,\nCVE-2025-21810, CVE-2024-57996, CVE-2024-58005, CVE-2025-21720,\nCVE-2025-21728, CVE-2024-58054, CVE-2024-58057, CVE-2025-21725,\nCVE-2025-21812, CVE-2025-21830, CVE-2024-58014, CVE-2025-21832,\nCVE-2024-58002, CVE-2025-21802, CVE-2024-57986, CVE-2025-21749,\nCVE-2024-58018, CVE-2024-57984, CVE-2025-21736, CVE-2024-58079,\nCVE-2024-58034, CVE-2024-57973, CVE-2024-57974, CVE-2025-21718,\nCVE-2025-21723, CVE-2024-58019, CVE-2025-21820, CVE-2024-58013,\nCVE-2025-21707, CVE-2024-58071, CVE-2025-21711, CVE-2024-58056,\nCVE-2024-58007, CVE-2024-58051, CVE-2025-21815, CVE-2024-57982,\nCVE-2025-21799, CVE-2025-21754, CVE-2025-21708, CVE-2025-21798,\nCVE-2024-57979, CVE-2024-57981, CVE-2024-58069, CVE-2025-21744,\nCVE-2025-21741, CVE-2024-58063, CVE-2024-58083, CVE-2024-57994,\nCVE-2025-21804, CVE-2025-21825, CVE-2024-57990, CVE-2025-21726,\nCVE-2025-21806, CVE-2024-57975, CVE-2025-21750, CVE-2025-21816,\nCVE-2025-37750)\n","status":"published","published":"2025-07-18T10:06:54Z","modified":"2026-10-30T21:55:35.179116171Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7651-3","title":"linux-aws-6.8, linux-gke, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle, linux-oracle-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2024-58058, CVE-2024-57984, CVE-2025-21727, CVE-2025-21812,\nCVE-2024-58070, CVE-2024-57974, CVE-2025-21810, CVE-2025-21816,\nCVE-2024-58085, CVE-2025-21738, CVE-2024-58057, CVE-2025-21733,\nCVE-2024-58054, CVE-2024-57994, CVE-2025-21721, CVE-2024-57979,\nCVE-2025-21825, CVE-2025-37750, CVE-2025-21750, CVE-2025-21798,\nCVE-2024-58080, CVE-2024-58034, CVE-2025-21724, CVE-2025-21714,\nCVE-2025-21742, CVE-2025-21720, CVE-2024-58077, CVE-2025-21710,\nCVE-2024-58014, CVE-2024-58052, CVE-2024-57986, CVE-2024-58007,\nCVE-2024-58017, CVE-2025-21731, CVE-2024-58056, CVE-2025-21722,\nCVE-2025-21826, CVE-2024-58079, CVE-2024-58005, CVE-2025-21732,\nCVE-2025-21749, CVE-2024-57998, CVE-2024-58055, CVE-2025-21809,\nCVE-2025-21806, CVE-2025-21820, CVE-2024-58010, CVE-2025-21829,\nCVE-2025-21705, CVE-2024-58082, CVE-2024-58051, CVE-2024-57982,\nCVE-2025-21723, CVE-2024-58053, CVE-2024-57973, CVE-2024-58006,\nCVE-2025-21707, CVE-2024-58061, CVE-2025-21735, CVE-2025-21804,\nCVE-2024-58068, CVE-2024-57996, CVE-2025-21748, CVE-2024-57999,\nCVE-2024-58069, CVE-2024-57953, CVE-2025-21718, CVE-2024-49887,\nCVE-2025-21708, CVE-2024-58063, CVE-2024-58001, CVE-2025-21811,\nCVE-2025-21744, CVE-2025-21754, CVE-2025-21734, CVE-2025-21715,\nCVE-2024-57981, CVE-2025-21743, CVE-2024-57990, CVE-2024-58011,\nCVE-2025-21745, CVE-2024-58076, CVE-2024-58002, CVE-2024-57997,\nCVE-2025-21728, CVE-2025-21802, CVE-2025-21830, CVE-2025-21719,\nCVE-2025-21711, CVE-2024-57975, CVE-2025-37974, CVE-2025-21716,\nCVE-2024-58071, CVE-2024-58019, CVE-2025-21828, CVE-2025-21832,\nCVE-2025-21799, CVE-2025-21739, CVE-2024-58083, CVE-2025-21725,\nCVE-2024-58013, CVE-2025-21801, CVE-2025-21808, CVE-2024-58003,\nCVE-2025-21814, CVE-2024-58016, CVE-2024-58072, CVE-2024-57993,\nCVE-2024-58018, CVE-2025-21726, CVE-2024-57980, CVE-2024-58081,\nCVE-2024-58078, CVE-2025-21736, CVE-2025-21753, CVE-2025-21741,\nCVE-2025-21815)\n","status":"published","published":"2025-07-22T07:35:00Z","modified":"2026-10-30T21:55:53.015604347Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7651-4","title":"linux-gcp, linux-gcp-6.8 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2024-58052, CVE-2025-21826, CVE-2025-21736, CVE-2025-21809,\nCVE-2025-21723, CVE-2024-57994, CVE-2025-21802, CVE-2024-58003,\nCVE-2024-58078, CVE-2025-21742, CVE-2025-21721, CVE-2024-57973,\nCVE-2025-21830, CVE-2025-21733, CVE-2025-21714, CVE-2024-58002,\nCVE-2025-21804, CVE-2025-21825, CVE-2024-58014, CVE-2024-58055,\nCVE-2025-21808, CVE-2024-57986, CVE-2024-57997, CVE-2024-57981,\nCVE-2025-21753, CVE-2025-21743, CVE-2025-37750, CVE-2024-57975,\nCVE-2025-21741, CVE-2025-21715, CVE-2025-21744, CVE-2025-21829,\nCVE-2025-21801, CVE-2025-21815, CVE-2024-58051, CVE-2024-58082,\nCVE-2024-58058, CVE-2024-58079, CVE-2024-58006, CVE-2024-58011,\nCVE-2025-21750, CVE-2024-57996, CVE-2025-21705, CVE-2024-58056,\nCVE-2024-58072, CVE-2025-21806, CVE-2024-57999, CVE-2025-21814,\nCVE-2024-58080, CVE-2024-57953, CVE-2025-37974, CVE-2025-21732,\nCVE-2024-58069, CVE-2024-58053, CVE-2024-58054, CVE-2025-21725,\nCVE-2025-21708, CVE-2025-21799, CVE-2024-57998, CVE-2024-57984,\nCVE-2025-21719, CVE-2024-58057, CVE-2024-57990, CVE-2024-57979,\nCVE-2025-21722, CVE-2025-21812, CVE-2024-58071, CVE-2024-57974,\nCVE-2024-58076, CVE-2024-57980, CVE-2024-58005, CVE-2024-58007,\nCVE-2024-58083, CVE-2025-21716, CVE-2025-21710, CVE-2025-21745,\nCVE-2024-58063, CVE-2024-58018, CVE-2024-57993, CVE-2024-49887,\nCVE-2025-21798, CVE-2024-58081, CVE-2025-21810, CVE-2024-58068,\nCVE-2024-58013, CVE-2025-21731, CVE-2024-57982, CVE-2025-21727,\nCVE-2025-21738, CVE-2025-21811, CVE-2024-58085, CVE-2025-21735,\nCVE-2025-21720, CVE-2025-21748, CVE-2025-21749, CVE-2024-58077,\nCVE-2025-21711, CVE-2025-21726, CVE-2025-21754, CVE-2024-58019,\nCVE-2025-21739, CVE-2024-58010, CVE-2024-58070, CVE-2025-21724,\nCVE-2024-58061, CVE-2025-21820, CVE-2025-21816, CVE-2025-21718,\nCVE-2024-58017, CVE-2025-21734, CVE-2025-21728, CVE-2024-58034,\nCVE-2024-58016, CVE-2024-58001, CVE-2025-21832, CVE-2025-21707,\nCVE-2025-21828)\n","status":"published","published":"2025-07-22T13:27:28Z","modified":"2026-10-30T21:55:27.371263318Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7651-5","title":"linux-raspi-realtime vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2024-57973, CVE-2024-58076, CVE-2025-21733, CVE-2024-58016,\nCVE-2024-58013, CVE-2025-21731, CVE-2024-58017, CVE-2024-58079,\nCVE-2025-21815, CVE-2025-21812, CVE-2025-21705, CVE-2025-21804,\nCVE-2025-21718, CVE-2025-21802, CVE-2025-21708, CVE-2024-58011,\nCVE-2025-21734, CVE-2025-21716, CVE-2024-57998, CVE-2025-21715,\nCVE-2024-57975, CVE-2024-57981, CVE-2025-21738, CVE-2025-21820,\nCVE-2025-21721, CVE-2024-58069, CVE-2025-21732, CVE-2025-21742,\nCVE-2025-21754, CVE-2025-21745, CVE-2024-57974, CVE-2025-21826,\nCVE-2025-37974, CVE-2025-21801, CVE-2024-58054, CVE-2024-58071,\nCVE-2025-21799, CVE-2024-58034, CVE-2024-58070, CVE-2025-21739,\nCVE-2024-58061, CVE-2024-57980, CVE-2025-21741, CVE-2024-57990,\nCVE-2025-21816, CVE-2025-21719, CVE-2024-57999, CVE-2025-37750,\nCVE-2024-49887, CVE-2025-21808, CVE-2024-58081, CVE-2025-21710,\nCVE-2025-21728, CVE-2024-58018, CVE-2025-21825, CVE-2024-57986,\nCVE-2025-21727, CVE-2024-57984, CVE-2025-21725, CVE-2024-57979,\nCVE-2024-58056, CVE-2025-21707, CVE-2025-21811, CVE-2024-58003,\nCVE-2024-58057, CVE-2024-58063, CVE-2024-58005, CVE-2025-21748,\nCVE-2024-57993, CVE-2024-58006, CVE-2025-21832, CVE-2024-58072,\nCVE-2025-21736, CVE-2025-21798, CVE-2025-21711, CVE-2024-58002,\nCVE-2024-58080, CVE-2025-21720, CVE-2024-58010, CVE-2025-21809,\nCVE-2025-21829, CVE-2024-58019, CVE-2025-21724, CVE-2024-58058,\nCVE-2025-21735, CVE-2024-57994, CVE-2024-58078, CVE-2024-57997,\nCVE-2025-21806, CVE-2024-58077, CVE-2024-58051, CVE-2024-58083,\nCVE-2024-58055, CVE-2025-21750, CVE-2024-58082, CVE-2024-58001,\nCVE-2025-21810, CVE-2025-21744, CVE-2024-57953, CVE-2024-58007,\nCVE-2025-21722, CVE-2025-21828, CVE-2025-21714, CVE-2024-58053,\nCVE-2025-21726, CVE-2024-58085, CVE-2024-58014, CVE-2024-58052,\nCVE-2025-21749, CVE-2025-21814, CVE-2025-21743, CVE-2024-57996,\nCVE-2025-21830, CVE-2025-21723, CVE-2024-58068, CVE-2025-21753,\nCVE-2024-57982)\n","status":"published","published":"2025-07-24T08:01:56Z","modified":"2026-10-30T21:55:25.731154522Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7651-6","title":"linux-raspi vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2025-21829, CVE-2025-21753, CVE-2024-58051, CVE-2025-21738,\nCVE-2025-21727, CVE-2025-21719, CVE-2024-57982, CVE-2025-21745,\nCVE-2024-58003, CVE-2025-21716, CVE-2025-21728, CVE-2024-58001,\nCVE-2024-58069, CVE-2025-21754, CVE-2025-21812, CVE-2025-21816,\nCVE-2024-58071, CVE-2024-58018, CVE-2025-21708, CVE-2024-58078,\nCVE-2025-21707, CVE-2025-21741, CVE-2024-57996, CVE-2024-58019,\nCVE-2024-58014, CVE-2024-58058, CVE-2024-57953, CVE-2025-21710,\nCVE-2024-58061, CVE-2025-21808, CVE-2025-21826, CVE-2025-21725,\nCVE-2025-21722, CVE-2025-21733, CVE-2024-58034, CVE-2025-21718,\nCVE-2025-21714, CVE-2025-21723, CVE-2025-21743, CVE-2025-21736,\nCVE-2024-58056, CVE-2025-21810, CVE-2024-58077, CVE-2024-58002,\nCVE-2024-49887, CVE-2025-21739, CVE-2024-57980, CVE-2025-21721,\nCVE-2025-21815, CVE-2025-21811, CVE-2024-57974, CVE-2024-58005,\nCVE-2025-21814, CVE-2024-58055, CVE-2025-21744, CVE-2025-21798,\nCVE-2024-58082, CVE-2024-58081, CVE-2025-21832, CVE-2024-58053,\nCVE-2025-21828, CVE-2024-58076, CVE-2025-21820, CVE-2024-58083,\nCVE-2024-58054, CVE-2024-57984, CVE-2025-21742, CVE-2024-58013,\nCVE-2025-21799, CVE-2025-21715, CVE-2025-21750, CVE-2025-21804,\nCVE-2024-57994, CVE-2024-58010, CVE-2024-58007, CVE-2024-58011,\nCVE-2024-57975, CVE-2025-37750, CVE-2025-21731, CVE-2025-21726,\nCVE-2024-58052, CVE-2024-57979, CVE-2025-21720, CVE-2025-21724,\nCVE-2024-57986, CVE-2024-58057, CVE-2024-58080, CVE-2024-58079,\nCVE-2024-57990, CVE-2025-21748, CVE-2025-21806, CVE-2025-21825,\nCVE-2024-58016, CVE-2025-21711, CVE-2024-58072, CVE-2025-21732,\nCVE-2024-57999, CVE-2024-57981, CVE-2024-58068, CVE-2025-21734,\nCVE-2024-58017, CVE-2024-57997, CVE-2025-21749, CVE-2025-37974,\nCVE-2025-21802, CVE-2024-58070, CVE-2025-21809, CVE-2024-58063,\nCVE-2024-58085, CVE-2025-21735, CVE-2024-57973, CVE-2024-58006,\nCVE-2024-57993, CVE-2025-21705, CVE-2024-57998, CVE-2025-21830,\nCVE-2025-21801)\n","status":"published","published":"2025-07-24T15:49:19Z","modified":"2026-10-30T21:55:26.111767947Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7652-1","title":"linux-realtime vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2024-58055, CVE-2024-58077, CVE-2024-58080, CVE-2024-58082,\nCVE-2025-21743, CVE-2024-57953, CVE-2024-57994, CVE-2025-21806,\nCVE-2024-58007, CVE-2024-58002, CVE-2024-57974, CVE-2024-57980,\nCVE-2025-21720, CVE-2024-57990, CVE-2025-21725, CVE-2024-58057,\nCVE-2024-58018, CVE-2024-58011, CVE-2025-21814, CVE-2025-21799,\nCVE-2024-58017, CVE-2024-58014, CVE-2025-21731, CVE-2024-58072,\nCVE-2024-58069, CVE-2024-58006, CVE-2024-57984, CVE-2025-21710,\nCVE-2024-58061, CVE-2024-57997, CVE-2024-57975, CVE-2025-21724,\nCVE-2025-37974, CVE-2025-21808, CVE-2024-58056, CVE-2025-21753,\nCVE-2024-58068, CVE-2025-21728, CVE-2025-21714, CVE-2024-58054,\nCVE-2025-21741, CVE-2025-21736, CVE-2025-21715, CVE-2025-21802,\nCVE-2025-21739, CVE-2025-21727, CVE-2025-21749, CVE-2024-58053,\nCVE-2024-58081, CVE-2025-21828, CVE-2025-21705, CVE-2024-58051,\nCVE-2024-57979, CVE-2025-21754, CVE-2025-21734, CVE-2025-21829,\nCVE-2025-21735, CVE-2025-21826, CVE-2025-21738, CVE-2024-58079,\nCVE-2025-21815, CVE-2025-21708, CVE-2024-57986, CVE-2024-58085,\nCVE-2025-21801, CVE-2024-58071, CVE-2025-21810, CVE-2025-21726,\nCVE-2025-21744, CVE-2025-21830, CVE-2025-21748, CVE-2024-58001,\nCVE-2024-58063, CVE-2024-57996, CVE-2025-21716, CVE-2024-58013,\nCVE-2024-58019, CVE-2025-21811, CVE-2025-21711, CVE-2024-58076,\nCVE-2024-58070, CVE-2024-57982, CVE-2024-57998, CVE-2025-21745,\nCVE-2025-21804, CVE-2024-57973, CVE-2024-58083, CVE-2025-21742,\nCVE-2025-37750, CVE-2025-21733, CVE-2025-21750, CVE-2024-57981,\nCVE-2025-21718, CVE-2024-58058, CVE-2024-49887, CVE-2024-58003,\nCVE-2024-57993, CVE-2024-57999, CVE-2024-58010, CVE-2025-21825,\nCVE-2025-21732, CVE-2025-21719, CVE-2025-21721, CVE-2024-58034,\nCVE-2024-58005, CVE-2025-21707, CVE-2025-21809, CVE-2024-58078,\nCVE-2025-21812, CVE-2024-58016, CVE-2025-21816, CVE-2024-58052,\nCVE-2025-21722, CVE-2025-21832, CVE-2025-21723, CVE-2025-21820,\nCVE-2025-21798)\n","status":"published","published":"2025-07-17T16:21:31Z","modified":"2026-10-30T21:55:25.660357905Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7653-1","title":"linux-hwe-6.8 vulnerabilities","description":"It was discovered that the CIFS network file system implementation in the\nLinux kernel did not properly verify the target namespace when handling\nupcalls. An attacker could use this to expose sensitive information.\n(CVE-2025-2312)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - Media staging drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB Serial drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Kernel CPU control infrastructure;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Memory management;\n  - Bluetooth subsystem;\n  - DCCP (Datagram Congestion Control Protocol);\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n(CVE-2025-21830, CVE-2025-21678, CVE-2025-21815, CVE-2024-57974,\nCVE-2025-21725, CVE-2025-21718, CVE-2025-21748, CVE-2025-21732,\nCVE-2024-57953, CVE-2025-21727, CVE-2025-21816, CVE-2025-21719,\nCVE-2024-53124, CVE-2024-58019, CVE-2025-38001, CVE-2025-21720,\nCVE-2025-21734, CVE-2025-21672, CVE-2025-21692, CVE-2024-58076,\nCVE-2025-21694, CVE-2024-58061, CVE-2025-21714, CVE-2025-21689,\nCVE-2024-49887, CVE-2024-57949, CVE-2025-38177, CVE-2025-21683,\nCVE-2025-21669, CVE-2025-21722, CVE-2024-57980, CVE-2025-38000,\nCVE-2025-37932, CVE-2024-58034, CVE-2024-58081, CVE-2025-21733,\nCVE-2025-21682, CVE-2024-57924, CVE-2025-21743, CVE-2024-57975,\nCVE-2025-37798, CVE-2024-58058, CVE-2025-21809, CVE-2025-21676,\nCVE-2024-57993, CVE-2025-21699, CVE-2024-58016, CVE-2025-21832,\nCVE-2025-21804, CVE-2024-58011, CVE-2024-58007, CVE-2025-21826,\nCVE-2024-58055, CVE-2025-21668, CVE-2025-21715, CVE-2024-58078,\nCVE-2025-21829, CVE-2025-21811, CVE-2025-21814, CVE-2024-58053,\nCVE-2025-21726, CVE-2025-21943, CVE-2025-37750, CVE-2025-21673,\nCVE-2024-57984, CVE-2025-37997, CVE-2025-21684, CVE-2025-21750,\nCVE-2024-58013, CVE-2025-21799, CVE-2024-58083, CVE-2025-21798,\nCVE-2025-21731, CVE-2025-21708, CVE-2024-57986, CVE-2025-21744,\nCVE-2024-58014, CVE-2025-21721, CVE-2024-58063, CVE-2024-57979,\nCVE-2024-58005, CVE-2025-21728, CVE-2025-21681, CVE-2025-21806,\nCVE-2024-57982, CVE-2024-58002, CVE-2024-58082, CVE-2025-21812,\nCVE-2025-21745, CVE-2024-58017, CVE-2025-21665, CVE-2025-21828,\nCVE-2025-37890, CVE-2024-57952, CVE-2024-57997, CVE-2025-21825,\nCVE-2025-21716, CVE-2024-57948, CVE-2025-21710, CVE-2025-21674,\nCVE-2025-21675, CVE-2024-50157, CVE-2025-21738, CVE-2025-22088,\nCVE-2024-58071, CVE-2024-58085, CVE-2025-21723, CVE-2025-21690,\nCVE-2025-21670, CVE-2025-21741, CVE-2024-57999, CVE-2025-21691,\nCVE-2024-58068, CVE-2024-58057, CVE-2024-57994, CVE-2024-58072,\nCVE-2025-21742, CVE-2024-58006, CVE-2024-58077, CVE-2024-58003,\nCVE-2025-21753, CVE-2024-57981, CVE-2024-57973, CVE-2024-58001,\nCVE-2025-21666, CVE-2025-21810, CVE-2025-21808, CVE-2024-57996,\nCVE-2024-58054, CVE-2024-57998, CVE-2025-21707, CVE-2025-21736,\nCVE-2025-21820, CVE-2025-21739, CVE-2024-57951, CVE-2025-21667,\nCVE-2024-58070, CVE-2025-21801, CVE-2024-58051, CVE-2024-58079,\nCVE-2025-21754, CVE-2024-58069, CVE-2025-37974, CVE-2025-21802,\nCVE-2025-21749, CVE-2024-57990, CVE-2024-58080, CVE-2025-21705,\nCVE-2025-21697, CVE-2024-58052, CVE-2025-21711, CVE-2024-58056,\nCVE-2025-21724, CVE-2024-58018, CVE-2025-21735, CVE-2024-58010,\nCVE-2025-21680)\n","status":"published","published":"2025-07-17T16:36:13Z","modified":"2026-11-03T14:31:43.554485963Z","updated_at":"2026-11-03T14:35:23.570529Z"},{"id":"USN-7737-1","title":"linux-azure, linux-azure-6.8, linux-azure-nvidia vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - FireWire subsystem;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - I3C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Operating Performance Points (OPP) driver;\n  - PCI subsystem;\n  - x86 platform drivers;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - Remote Processor subsystem;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Framebuffer layer;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - F2FS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - SMB network file system;\n  - UBI file system;\n  - Timer subsystem;\n  - KVM subsystem;\n  - Networking core;\n  - ptr_ring data structure definitions;\n  - Networking subsytem;\n  - Amateur Radio drivers;\n  - L3 Master device support module;\n  - TCP network protocol;\n  - XFRM subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - Process Accounting mechanism;\n  - BPF subsystem;\n  - Padata parallel execution mechanism;\n  - printk logging mechanism;\n  - Workqueue subsystem;\n  - Memory management;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - Landlock security;\n  - Linux Security Modules (LSM) Framework;\n  - Tomoyo security module;\n  - SoC audio core drivers;\n  - SOF drivers;\n(CVE-2025-37750, CVE-2025-21707, CVE-2025-21814, CVE-2025-21863,\nCVE-2025-21775, CVE-2024-57997, CVE-2025-21749, CVE-2025-21739,\nCVE-2025-21829, CVE-2025-21731, CVE-2025-21704, CVE-2024-57979,\nCVE-2025-21864, CVE-2024-57953, CVE-2025-21796, CVE-2025-21826,\nCVE-2024-57998, CVE-2025-21784, CVE-2024-58072, CVE-2025-21859,\nCVE-2025-21790, CVE-2025-21762, CVE-2025-37797, CVE-2024-57981,\nCVE-2024-58068, CVE-2025-21810, CVE-2024-58070, CVE-2025-21738,\nCVE-2024-58081, CVE-2024-58010, CVE-2025-21832, CVE-2025-21839,\nCVE-2024-58061, CVE-2024-58069, CVE-2024-58055, CVE-2024-57834,\nCVE-2025-21804, CVE-2025-21783, CVE-2025-21772, CVE-2024-57975,\nCVE-2024-57980, CVE-2024-58082, CVE-2025-21741, CVE-2025-21733,\nCVE-2025-21750, CVE-2025-21728, CVE-2025-21716, CVE-2025-21753,\nCVE-2025-21802, CVE-2024-57993, CVE-2025-21785, CVE-2024-57994,\nCVE-2025-21868, CVE-2025-21812, CVE-2025-21760, CVE-2025-21782,\nCVE-2025-21763, CVE-2024-57999, CVE-2025-21823, CVE-2024-57986,\nCVE-2024-58080, CVE-2025-21766, CVE-2025-21743, CVE-2025-21838,\nCVE-2025-21706, CVE-2025-21820, CVE-2024-58003, CVE-2025-21809,\nCVE-2025-21867, CVE-2024-57982, CVE-2025-21759, CVE-2024-57984,\nCVE-2025-21736, CVE-2024-58058, CVE-2025-21754, CVE-2024-49887,\nCVE-2025-21781, CVE-2025-21795, CVE-2025-21746, CVE-2024-58019,\nCVE-2025-21780, CVE-2024-58083, CVE-2025-21734, CVE-2025-21764,\nCVE-2025-21825, CVE-2024-54456, CVE-2024-58056, CVE-2025-21861,\nCVE-2024-57973, CVE-2025-21735, CVE-2025-21705, CVE-2024-57990,\nCVE-2025-21836, CVE-2025-21816, CVE-2024-58088, CVE-2024-58005,\nCVE-2025-21761, CVE-2025-21791, CVE-2025-21808, CVE-2025-21723,\nCVE-2025-21848, CVE-2025-21870, CVE-2024-58076, CVE-2025-21854,\nCVE-2024-58093, CVE-2024-57977, CVE-2024-58034, CVE-2024-58011,\nCVE-2024-58051, CVE-2025-21847, CVE-2025-21866, CVE-2024-58013,\nCVE-2025-21786, CVE-2025-21856, CVE-2025-21765, CVE-2024-58057,\nCVE-2024-54458, CVE-2024-58002, CVE-2025-21715, CVE-2025-21798,\nCVE-2025-21725, CVE-2025-21858, CVE-2025-21768, CVE-2025-21792,\nCVE-2024-58052, CVE-2025-21721, CVE-2025-21773, CVE-2025-21835,\nCVE-2025-21853, CVE-2025-21869, CVE-2025-21722, CVE-2025-21724,\nCVE-2024-58020, CVE-2025-21710, CVE-2024-58016, CVE-2025-21718,\nCVE-2025-21767, CVE-2024-58079, CVE-2025-21779, CVE-2025-21857,\nCVE-2024-58017, CVE-2025-21719, CVE-2024-58001, CVE-2025-21758,\nCVE-2024-58054, CVE-2024-58077, CVE-2025-21793, CVE-2024-58014,\nCVE-2025-21830, CVE-2024-58071, CVE-2025-21748, CVE-2025-21806,\nCVE-2024-58006, CVE-2025-21844, CVE-2025-21745, CVE-2024-58063,\nCVE-2024-58007, CVE-2025-21712, CVE-2024-58086, CVE-2025-21846,\nCVE-2025-21711, CVE-2025-21787, CVE-2025-38083, CVE-2025-21742,\nCVE-2025-21732, CVE-2025-21714, CVE-2025-21744, CVE-2025-21776,\nCVE-2024-52559, CVE-2025-21801, CVE-2025-21720, CVE-2025-21828,\nCVE-2024-57974, CVE-2025-21821, CVE-2025-21811, CVE-2024-58053,\nCVE-2025-21855, CVE-2025-21726, CVE-2025-21862, CVE-2025-21815,\nCVE-2024-58018, CVE-2025-21727, CVE-2025-21871, CVE-2024-58078,\nCVE-2024-58085, CVE-2025-21799, CVE-2025-21708, CVE-2025-37974)\n","status":"published","published":"2025-09-03T18:03:06Z","modified":"2026-11-03T14:33:51.642165448Z","updated_at":"2026-11-03T15:17:23.859376Z"}]}}