{"id":"CVE-2025-38238","aliases":["BELL-CVE-2025-38238","EUVD-2025-20822","GHSA-xh6p-h9xv-5c64","SUSE-SU-2025:02853-1","SUSE-SU-2025:02997-1","SUSE-SU-2025:03011-1","SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","UBUNTU-CVE-2025-38238","USN-7833-1","USN-7833-2","USN-7833-3","USN-7833-4","USN-7834-1","USN-7856-1","openSUSE-SU-2026:21555-1"],"status":"published","title":"scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0021,"percentile":0.11303,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-07-09T10:42:23Z","modified":"2026-11-03T14:34:03Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.15.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","fixed_in":["6.14.0-1015.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","fixed_in":["6.14.0-1014.14~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","fixed_in":["6.14.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","fixed_in":["6.14.0-1018.19~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","fixed_in":["6.14.0-1014.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","fixed_in":["6.14.0-1015.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","fixed_in":["6.14.0-34.34.1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","fixed_in":["6.14.0-1014.14~24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.15.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.5.1"}]}],"bundled":260},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.13.1"}]}],"bundled":260},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.13.1"}]}],"bundled":260},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.13.1"}]}],"bundled":260},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1.150700.17.9.4"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.3"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.4"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.11.1"}]}],"bundled":264},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.11.1"}]}],"bundled":265},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.11.1"}]}],"bundled":265},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.11.1"}]}],"bundled":265},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1015.15~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14~24.04.1"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1007.7"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1018.19~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1015.15~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-34.34.1~24.04.1"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14~24.04.1"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1015.15~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14~24.04.1"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1015.15~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1018.19~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14~24.04.1"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1007.7"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-34.34~24.04.1"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1"],"bundled":181},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/09679e9abedfbc5a2590759a1a7893c1c26e6044","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38238","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xh6p-h9xv-5c64"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-38238","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38238.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502853-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204142","tags":["report"]},{"url":"https://bugzilla.suse.com/1219338","tags":["report"]},{"url":"https://bugzilla.suse.com/1225707","tags":["report"]},{"url":"https://bugzilla.suse.com/1228664","tags":["report"]},{"url":"https://bugzilla.suse.com/1230216","tags":["report"]},{"url":"https://bugzilla.suse.com/1233300","tags":["report"]},{"url":"https://bugzilla.suse.com/1235515","tags":["report"]},{"url":"https://bugzilla.suse.com/1235613","tags":["report"]},{"url":"https://bugzilla.suse.com/1235837","tags":["report"]},{"url":"https://bugzilla.suse.com/1236333","tags":["report"]},{"url":"https://bugzilla.suse.com/1236897","tags":["report"]},{"url":"https://bugzilla.suse.com/1238896","tags":["report"]},{"url":"https://bugzilla.suse.com/1239061","tags":["report"]},{"url":"https://bugzilla.suse.com/1240323","tags":["report"]},{"url":"https://bugzilla.suse.com/1240696","tags":["report"]},{"url":"https://bugzilla.suse.com/1240885","tags":["report"]},{"url":"https://bugzilla.suse.com/1240966","tags":["report"]},{"url":"https://bugzilla.suse.com/1240998","tags":["report"]},{"url":"https://bugzilla.suse.com/1241166","tags":["report"]},{"url":"https://bugzilla.suse.com/1241200","tags":["report"]},{"url":"https://bugzilla.suse.com/1241345","tags":["report"]},{"url":"https://bugzilla.suse.com/1242086","tags":["report"]},{"url":"https://bugzilla.suse.com/1242414","tags":["report"]},{"url":"https://bugzilla.suse.com/1242837","tags":["report"]},{"url":"https://bugzilla.suse.com/1242960","tags":["report"]},{"url":"https://bugzilla.suse.com/1242965","tags":["report"]},{"url":"https://bugzilla.suse.com/1242993","tags":["report"]},{"url":"https://bugzilla.suse.com/1243042","tags":["report"]},{"url":"https://bugzilla.suse.com/1243068","tags":["report"]},{"url":"https://bugzilla.suse.com/1243100","tags":["report"]},{"url":"https://bugzilla.suse.com/1243479","tags":["report"]},{"url":"https://bugzilla.suse.com/1243669","tags":["report"]},{"url":"https://bugzilla.suse.com/1243678","tags":["report"]},{"url":"https://bugzilla.suse.com/1243806","tags":["report"]},{"url":"https://bugzilla.suse.com/1244309","tags":["report"]},{"url":"https://bugzilla.suse.com/1244457","tags":["report"]},{"url":"https://bugzilla.suse.com/1244735","tags":["report"]},{"url":"https://bugzilla.suse.com/1244749","tags":["report"]},{"url":"https://bugzilla.suse.com/1244750","tags":["report"]},{"url":"https://bugzilla.suse.com/1244792","tags":["report"]},{"url":"https://bugzilla.suse.com/1244801","tags":["report"]},{"url":"https://bugzilla.suse.com/1245084","tags":["report"]},{"url":"https://bugzilla.suse.com/1245151","tags":["report"]},{"url":"https://bugzilla.suse.com/1245201","tags":["report"]},{"url":"https://bugzilla.suse.com/1245202","tags":["report"]},{"url":"https://bugzilla.suse.com/1245216","tags":["report"]},{"url":"https://bugzilla.suse.com/1245260","tags":["report"]},{"url":"https://bugzilla.suse.com/1245431","tags":["report"]},{"url":"https://bugzilla.suse.com/1245440","tags":["report"]},{"url":"https://bugzilla.suse.com/1245457","tags":["report"]},{"url":"https://bugzilla.suse.com/1245498","tags":["report"]},{"url":"https://bugzilla.suse.com/1245499","tags":["report"]},{"url":"https://bugzilla.suse.com/1245504","tags":["report"]},{"url":"https://bugzilla.suse.com/1245506","tags":["report"]},{"url":"https://bugzilla.suse.com/1245508","tags":["report"]},{"url":"https://bugzilla.suse.com/1245510","tags":["report"]},{"url":"https://bugzilla.suse.com/1245540","tags":["report"]},{"url":"https://bugzilla.suse.com/1245598","tags":["report"]},{"url":"https://bugzilla.suse.com/1245599","tags":["report"]},{"url":"https://bugzilla.suse.com/1245621","tags":["report"]},{"url":"https://bugzilla.suse.com/1245646","tags":["report"]},{"url":"https://bugzilla.suse.com/1245647","tags":["report"]},{"url":"https://bugzilla.suse.com/1245649","tags":["report"]},{"url":"https://bugzilla.suse.com/1245650","tags":["report"]},{"url":"https://bugzilla.suse.com/1245654","tags":["report"]},{"url":"https://bugzilla.suse.com/1245658","tags":["report"]},{"url":"https://bugzilla.suse.com/1245660","tags":["report"]},{"url":"https://bugzilla.suse.com/1245664","tags":["report"]},{"url":"https://bugzilla.suse.com/1245665","tags":["report"]},{"url":"https://bugzilla.suse.com/1245666","tags":["report"]},{"url":"https://bugzilla.suse.com/1245668","tags":["report"]},{"url":"https://bugzilla.suse.com/1245669","tags":["report"]},{"url":"https://bugzilla.suse.com/1245670","tags":["report"]},{"url":"https://bugzilla.suse.com/1245671","tags":["report"]},{"url":"https://bugzilla.suse.com/1245675","tags":["report"]},{"url":"https://bugzilla.suse.com/1245676","tags":["report"]},{"url":"https://bugzilla.suse.com/1245677","tags":["report"]},{"url":"https://bugzilla.suse.com/1245679","tags":["report"]},{"url":"https://bugzilla.suse.com/1245682","tags":["report"]},{"url":"https://bugzilla.suse.com/1245683","tags":["report"]},{"url":"https://bugzilla.suse.com/1245684","tags":["report"]},{"url":"https://bugzilla.suse.com/1245686","tags":["report"]},{"url":"https://bugzilla.suse.com/1245688","tags":["report"]},{"url":"https://bugzilla.suse.com/1245689","tags":["report"]},{"url":"https://bugzilla.suse.com/1245690","tags":["report"]},{"url":"https://bugzilla.suse.com/1245691","tags":["report"]},{"url":"https://bugzilla.suse.com/1245695","tags":["report"]},{"url":"https://bugzilla.suse.com/1245705","tags":["report"]},{"url":"https://bugzilla.suse.com/1245708","tags":["report"]},{"url":"https://bugzilla.suse.com/1245711","tags":["report"]},{"url":"https://bugzilla.suse.com/1245713","tags":["report"]},{"url":"https://bugzilla.suse.com/1245714","tags":["report"]},{"url":"https://bugzilla.suse.com/1245719","tags":["report"]},{"url":"https://bugzilla.suse.com/1245723","tags":["report"]},{"url":"https://bugzilla.suse.com/1245729","tags":["report"]},{"url":"https://bugzilla.suse.com/1245730","tags":["report"]},{"url":"https://bugzilla.suse.com/1245731","tags":["report"]},{"url":"https://bugzilla.suse.com/1245735","tags":["report"]},{"url":"https://bugzilla.suse.com/1245737","tags":["report"]},{"url":"https://bugzilla.suse.com/1245744","tags":["report"]},{"url":"https://bugzilla.suse.com/1245745","tags":["report"]},{"url":"https://bugzilla.suse.com/1245746","tags":["report"]},{"url":"https://bugzilla.suse.com/1245747","tags":["report"]},{"url":"https://bugzilla.suse.com/1245748","tags":["report"]},{"url":"https://bugzilla.suse.com/1245749","tags":["report"]},{"url":"https://bugzilla.suse.com/1245750","tags":["report"]},{"url":"https://bugzilla.suse.com/1245751","tags":["report"]},{"url":"https://bugzilla.suse.com/1245752","tags":["report"]},{"url":"https://bugzilla.suse.com/1245757","tags":["report"]},{"url":"https://bugzilla.suse.com/1245758","tags":["report"]},{"url":"https://bugzilla.suse.com/1245765","tags":["report"]},{"url":"https://bugzilla.suse.com/1245768","tags":["report"]},{"url":"https://bugzilla.suse.com/1245769","tags":["report"]},{"url":"https://bugzilla.suse.com/1245777","tags":["report"]},{"url":"https://bugzilla.suse.com/1245781","tags":["report"]},{"url":"https://bugzilla.suse.com/1245789","tags":["report"]},{"url":"https://bugzilla.suse.com/1245812","tags":["report"]},{"url":"https://bugzilla.suse.com/1245937","tags":["report"]},{"url":"https://bugzilla.suse.com/1245945","tags":["report"]},{"url":"https://bugzilla.suse.com/1245951","tags":["report"]},{"url":"https://bugzilla.suse.com/1245952","tags":["report"]},{"url":"https://bugzilla.suse.com/1245954","tags":["report"]},{"url":"https://bugzilla.suse.com/1245955","tags":["report"]},{"url":"https://bugzilla.suse.com/1245957","tags":["report"]},{"url":"https://bugzilla.suse.com/1245966","tags":["report"]},{"url":"https://bugzilla.suse.com/1245970","tags":["report"]},{"url":"https://bugzilla.suse.com/1245976","tags":["report"]},{"url":"https://bugzilla.suse.com/1245980","tags":["report"]},{"url":"https://bugzilla.suse.com/1245983","tags":["report"]},{"url":"https://bugzilla.suse.com/1245986","tags":["report"]},{"url":"https://bugzilla.suse.com/1246000","tags":["report"]},{"url":"https://bugzilla.suse.com/1246002","tags":["report"]},{"url":"https://bugzilla.suse.com/1246006","tags":["report"]},{"url":"https://bugzilla.suse.com/1246008","tags":["report"]},{"url":"https://bugzilla.suse.com/1246020","tags":["report"]},{"url":"https://bugzilla.suse.com/1246023","tags":["report"]},{"url":"https://bugzilla.suse.com/1246029","tags":["report"]},{"url":"https://bugzilla.suse.com/1246031","tags":["report"]},{"url":"https://bugzilla.suse.com/1246037","tags":["report"]},{"url":"https://bugzilla.suse.com/1246041","tags":["report"]},{"url":"https://bugzilla.suse.com/1246042","tags":["report"]},{"url":"https://bugzilla.suse.com/1246044","tags":["report"]},{"url":"https://bugzilla.suse.com/1246045","tags":["report"]},{"url":"https://bugzilla.suse.com/1246047","tags":["report"]},{"url":"https://bugzilla.suse.com/1246049","tags":["report"]},{"url":"https://bugzilla.suse.com/1246050","tags":["report"]},{"url":"https://bugzilla.suse.com/1246055","tags":["report"]},{"url":"https://bugzilla.suse.com/1246073","tags":["report"]},{"url":"https://bugzilla.suse.com/1246093","tags":["report"]},{"url":"https://bugzilla.suse.com/1246098","tags":["report"]},{"url":"https://bugzilla.suse.com/1246109","tags":["report"]},{"url":"https://bugzilla.suse.com/1246113","tags":["report"]},{"url":"https://bugzilla.suse.com/1246122","tags":["report"]},{"url":"https://bugzilla.suse.com/1246125","tags":["report"]},{"url":"https://bugzilla.suse.com/1246134","tags":["report"]},{"url":"https://bugzilla.suse.com/1246171","tags":["report"]},{"url":"https://bugzilla.suse.com/1246173","tags":["report"]},{"url":"https://bugzilla.suse.com/1246178","tags":["report"]},{"url":"https://bugzilla.suse.com/1246179","tags":["report"]},{"url":"https://bugzilla.suse.com/1246182","tags":["report"]},{"url":"https://bugzilla.suse.com/1246183","tags":["report"]},{"url":"https://bugzilla.suse.com/1246186","tags":["report"]},{"url":"https://bugzilla.suse.com/1246188","tags":["report"]},{"url":"https://bugzilla.suse.com/1246195","tags":["report"]},{"url":"https://bugzilla.suse.com/1246203","tags":["report"]},{"url":"https://bugzilla.suse.com/1246212","tags":["report"]},{"url":"https://bugzilla.suse.com/1246217","tags":["report"]},{"url":"https://bugzilla.suse.com/1246220","tags":["report"]},{"url":"https://bugzilla.suse.com/1246236","tags":["report"]},{"url":"https://bugzilla.suse.com/1246240","tags":["report"]},{"url":"https://bugzilla.suse.com/1246243","tags":["report"]},{"url":"https://bugzilla.suse.com/1246244","tags":["report"]},{"url":"https://bugzilla.suse.com/1246246","tags":["report"]},{"url":"https://bugzilla.suse.com/1246249","tags":["report"]},{"url":"https://bugzilla.suse.com/1246250","tags":["report"]},{"url":"https://bugzilla.suse.com/1246253","tags":["report"]},{"url":"https://bugzilla.suse.com/1246258","tags":["report"]},{"url":"https://bugzilla.suse.com/1246262","tags":["report"]},{"url":"https://bugzilla.suse.com/1246264","tags":["report"]},{"url":"https://bugzilla.suse.com/1246266","tags":["report"]},{"url":"https://bugzilla.suse.com/1246268","tags":["report"]},{"url":"https://bugzilla.suse.com/1246273","tags":["report"]},{"url":"https://bugzilla.suse.com/1246283","tags":["report"]},{"url":"https://bugzilla.suse.com/1246285","tags":["report"]},{"url":"https://bugzilla.suse.com/1246286","tags":["report"]},{"url":"https://bugzilla.suse.com/1246287","tags":["report"]},{"url":"https://bugzilla.suse.com/1246290","tags":["report"]},{"url":"https://bugzilla.suse.com/1246292","tags":["report"]},{"url":"https://bugzilla.suse.com/1246293","tags":["report"]},{"url":"https://bugzilla.suse.com/1246295","tags":["report"]},{"url":"https://bugzilla.suse.com/1246297","tags":["report"]},{"url":"https://bugzilla.suse.com/1246333","tags":["report"]},{"url":"https://bugzilla.suse.com/1246334","tags":["report"]},{"url":"https://bugzilla.suse.com/1246337","tags":["report"]},{"url":"https://bugzilla.suse.com/1246342","tags":["report"]},{"url":"https://bugzilla.suse.com/1246349","tags":["report"]},{"url":"https://bugzilla.suse.com/1246354","tags":["report"]},{"url":"https://bugzilla.suse.com/1246358","tags":["report"]},{"url":"https://bugzilla.suse.com/1246361","tags":["report"]},{"url":"https://bugzilla.suse.com/1246364","tags":["report"]},{"url":"https://bugzilla.suse.com/1246370","tags":["report"]},{"url":"https://bugzilla.suse.com/1246375","tags":["report"]},{"url":"https://bugzilla.suse.com/1246384","tags":["report"]},{"url":"https://bugzilla.suse.com/1246385","tags":["report"]},{"url":"https://bugzilla.suse.com/1246386","tags":["report"]},{"url":"https://bugzilla.suse.com/1246387","tags":["report"]},{"url":"https://bugzilla.suse.com/1246438","tags":["report"]},{"url":"https://bugzilla.suse.com/1246443","tags":["report"]},{"url":"https://bugzilla.suse.com/1246449","tags":["report"]},{"url":"https://bugzilla.suse.com/1246453","tags":["report"]},{"url":"https://bugzilla.suse.com/1246473","tags":["report"]},{"url":"https://bugzilla.suse.com/1246490","tags":["report"]},{"url":"https://bugzilla.suse.com/1246506","tags":["report"]},{"url":"https://bugzilla.suse.com/1246547","tags":["report"]},{"url":"https://bugzilla.suse.com/1246644","tags":["report"]},{"url":"https://bugzilla.suse.com/1246777","tags":["report"]},{"url":"https://bugzilla.suse.com/1246781","tags":["report"]},{"url":"https://bugzilla.suse.com/1246870","tags":["report"]},{"url":"https://bugzilla.suse.com/1246879","tags":["report"]},{"url":"https://bugzilla.suse.com/1246911","tags":["report"]},{"url":"https://bugzilla.suse.com/1247018","tags":["report"]},{"url":"https://bugzilla.suse.com/1247021","tags":["report"]},{"url":"https://bugzilla.suse.com/1247023","tags":["report"]},{"url":"https://bugzilla.suse.com/1247028","tags":["report"]},{"url":"https://bugzilla.suse.com/1247031","tags":["report"]},{"url":"https://bugzilla.suse.com/1247033","tags":["report"]},{"url":"https://bugzilla.suse.com/1247035","tags":["report"]},{"url":"https://bugzilla.suse.com/1247061","tags":["report"]},{"url":"https://bugzilla.suse.com/1247062","tags":["report"]},{"url":"https://bugzilla.suse.com/1247064","tags":["report"]},{"url":"https://bugzilla.suse.com/1247079","tags":["report"]},{"url":"https://bugzilla.suse.com/1247089","tags":["report"]},{"url":"https://bugzilla.suse.com/1247091","tags":["report"]},{"url":"https://bugzilla.suse.com/1247097","tags":["report"]},{"url":"https://bugzilla.suse.com/1247098","tags":["report"]},{"url":"https://bugzilla.suse.com/1247101","tags":["report"]},{"url":"https://bugzilla.suse.com/1247103","tags":["report"]},{"url":"https://bugzilla.suse.com/1247104","tags":["report"]},{"url":"https://bugzilla.suse.com/1247113","tags":["report"]},{"url":"https://bugzilla.suse.com/1247118","tags":["report"]},{"url":"https://bugzilla.suse.com/1247123","tags":["report"]},{"url":"https://bugzilla.suse.com/1247125","tags":["report"]},{"url":"https://bugzilla.suse.com/1247128","tags":["report"]},{"url":"https://bugzilla.suse.com/1247132","tags":["report"]},{"url":"https://bugzilla.suse.com/1247138","tags":["report"]},{"url":"https://bugzilla.suse.com/1247141","tags":["report"]},{"url":"https://bugzilla.suse.com/1247143","tags":["report"]},{"url":"https://bugzilla.suse.com/1247145","tags":["report"]},{"url":"https://bugzilla.suse.com/1247146","tags":["report"]},{"url":"https://bugzilla.suse.com/1247147","tags":["report"]},{"url":"https://bugzilla.suse.com/1247149","tags":["report"]},{"url":"https://bugzilla.suse.com/1247150","tags":["report"]},{"url":"https://bugzilla.suse.com/1247151","tags":["report"]},{"url":"https://bugzilla.suse.com/1247152","tags":["report"]},{"url":"https://bugzilla.suse.com/1247153","tags":["report"]},{"url":"https://bugzilla.suse.com/1247154","tags":["report"]},{"url":"https://bugzilla.suse.com/1247156","tags":["report"]},{"url":"https://bugzilla.suse.com/1247160","tags":["report"]},{"url":"https://bugzilla.suse.com/1247164","tags":["report"]},{"url":"https://bugzilla.suse.com/1247169","tags":["report"]},{"url":"https://bugzilla.suse.com/1247170","tags":["report"]},{"url":"https://bugzilla.suse.com/1247171","tags":["report"]},{"url":"https://bugzilla.suse.com/1247172","tags":["report"]},{"url":"https://bugzilla.suse.com/1247174","tags":["report"]},{"url":"https://bugzilla.suse.com/1247176","tags":["report"]},{"url":"https://bugzilla.suse.com/1247177","tags":["report"]},{"url":"https://bugzilla.suse.com/1247178","tags":["report"]},{"url":"https://bugzilla.suse.com/1247181","tags":["report"]},{"url":"https://bugzilla.suse.com/1247209","tags":["report"]},{"url":"https://bugzilla.suse.com/1247210","tags":["report"]},{"url":"https://bugzilla.suse.com/1247227","tags":["report"]},{"url":"https://bugzilla.suse.com/1247233","tags":["report"]},{"url":"https://bugzilla.suse.com/1247234","tags":["report"]},{"url":"https://bugzilla.suse.com/1247236","tags":["report"]},{"url":"https://bugzilla.suse.com/1247238","tags":["report"]},{"url":"https://bugzilla.suse.com/1247241","tags":["report"]},{"url":"https://bugzilla.suse.com/1247251","tags":["report"]},{"url":"https://bugzilla.suse.com/1247252","tags":["report"]},{"url":"https://bugzilla.suse.com/1247253","tags":["report"]},{"url":"https://bugzilla.suse.com/1247255","tags":["report"]},{"url":"https://bugzilla.suse.com/1247265","tags":["report"]},{"url":"https://bugzilla.suse.com/1247271","tags":["report"]},{"url":"https://bugzilla.suse.com/1247273","tags":["report"]},{"url":"https://bugzilla.suse.com/1247274","tags":["report"]},{"url":"https://bugzilla.suse.com/1247276","tags":["report"]},{"url":"https://bugzilla.suse.com/1247277","tags":["report"]},{"url":"https://bugzilla.suse.com/1247278","tags":["report"]},{"url":"https://bugzilla.suse.com/1247279","tags":["report"]},{"url":"https://bugzilla.suse.com/1247282","tags":["report"]},{"url":"https://bugzilla.suse.com/1247284","tags":["report"]},{"url":"https://bugzilla.suse.com/1247285","tags":["report"]},{"url":"https://bugzilla.suse.com/1247288","tags":["report"]},{"url":"https://bugzilla.suse.com/1247289","tags":["report"]},{"url":"https://bugzilla.suse.com/1247293","tags":["report"]},{"url":"https://bugzilla.suse.com/1247308","tags":["report"]},{"url":"https://bugzilla.suse.com/1247311","tags":["report"]},{"url":"https://bugzilla.suse.com/1247314","tags":["report"]},{"url":"https://bugzilla.suse.com/1247317","tags":["report"]},{"url":"https://bugzilla.suse.com/1247347","tags":["report"]},{"url":"https://bugzilla.suse.com/1247348","tags":["report"]},{"url":"https://bugzilla.suse.com/1247349","tags":["report"]},{"url":"https://bugzilla.suse.com/1247374","tags":["report"]},{"url":"https://bugzilla.suse.com/1247437","tags":["report"]},{"url":"https://bugzilla.suse.com/1247450","tags":["report"]},{"url":"https://bugzilla.suse.com/1247712","tags":["report"]},{"url":"https://bugzilla.suse.com/1247831","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502997-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1139073","tags":["report"]},{"url":"https://bugzilla.suse.com/1227082","tags":["report"]},{"url":"https://bugzilla.suse.com/1239470","tags":["report"]},{"url":"https://bugzilla.suse.com/1241537","tags":["report"]},{"url":"https://bugzilla.suse.com/1244337","tags":["report"]},{"url":"https://bugzilla.suse.com/1246695","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232089","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623066-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185845","tags":["report"]},{"url":"https://bugzilla.suse.com/1234634","tags":["report"]},{"url":"https://bugzilla.suse.com/1237449","tags":["report"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1247455","tags":["report"]},{"url":"https://bugzilla.suse.com/1248480","tags":["report"]},{"url":"https://bugzilla.suse.com/1248611","tags":["report"]},{"url":"https://bugzilla.suse.com/1251966","tags":["report"]},{"url":"https://bugzilla.suse.com/1252682","tags":["report"]},{"url":"https://bugzilla.suse.com/1253262","tags":["report"]},{"url":"https://bugzilla.suse.com/1253434","tags":["report"]},{"url":"https://bugzilla.suse.com/1253454","tags":["report"]},{"url":"https://bugzilla.suse.com/1254306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255224","tags":["report"]},{"url":"https://bugzilla.suse.com/1255250","tags":["report"]},{"url":"https://bugzilla.suse.com/1255441","tags":["report"]},{"url":"https://bugzilla.suse.com/1255687","tags":["report"]},{"url":"https://bugzilla.suse.com/1257721","tags":["report"]},{"url":"https://bugzilla.suse.com/1257777","tags":["report"]},{"url":"https://bugzilla.suse.com/1258472","tags":["report"]},{"url":"https://bugzilla.suse.com/1258718","tags":["report"]},{"url":"https://bugzilla.suse.com/1259329","tags":["report"]},{"url":"https://bugzilla.suse.com/1259762","tags":["report"]},{"url":"https://bugzilla.suse.com/1259764","tags":["report"]},{"url":"https://bugzilla.suse.com/1259866","tags":["report"]},{"url":"https://bugzilla.suse.com/1259955","tags":["report"]},{"url":"https://bugzilla.suse.com/1260012","tags":["report"]},{"url":"https://bugzilla.suse.com/1260347","tags":["report"]},{"url":"https://bugzilla.suse.com/1260553","tags":["report"]},{"url":"https://bugzilla.suse.com/1260593","tags":["report"]},{"url":"https://bugzilla.suse.com/1261250","tags":["report"]},{"url":"https://bugzilla.suse.com/1261562","tags":["report"]},{"url":"https://bugzilla.suse.com/1261590","tags":["report"]},{"url":"https://bugzilla.suse.com/1262160","tags":["report"]},{"url":"https://bugzilla.suse.com/1262391","tags":["report"]},{"url":"https://bugzilla.suse.com/1262573","tags":["report"]},{"url":"https://bugzilla.suse.com/1262602","tags":["report"]},{"url":"https://bugzilla.suse.com/1262603","tags":["report"]},{"url":"https://bugzilla.suse.com/1262605","tags":["report"]},{"url":"https://bugzilla.suse.com/1262614","tags":["report"]},{"url":"https://bugzilla.suse.com/1262637","tags":["report"]},{"url":"https://bugzilla.suse.com/1262639","tags":["report"]},{"url":"https://bugzilla.suse.com/1262640","tags":["report"]},{"url":"https://bugzilla.suse.com/1262652","tags":["report"]},{"url":"https://bugzilla.suse.com/1262653","tags":["report"]},{"url":"https://bugzilla.suse.com/1262655","tags":["report"]},{"url":"https://bugzilla.suse.com/1262658","tags":["report"]},{"url":"https://bugzilla.suse.com/1262659","tags":["report"]},{"url":"https://bugzilla.suse.com/1262663","tags":["report"]},{"url":"https://bugzilla.suse.com/1262678","tags":["report"]},{"url":"https://bugzilla.suse.com/1262679","tags":["report"]},{"url":"https://bugzilla.suse.com/1262723","tags":["report"]},{"url":"https://bugzilla.suse.com/1262734","tags":["report"]},{"url":"https://bugzilla.suse.com/1262745","tags":["report"]},{"url":"https://bugzilla.suse.com/1262746","tags":["report"]},{"url":"https://bugzilla.suse.com/1262751","tags":["report"]},{"url":"https://bugzilla.suse.com/1262757","tags":["report"]},{"url":"https://bugzilla.suse.com/1262768","tags":["report"]},{"url":"https://bugzilla.suse.com/1262770","tags":["report"]},{"url":"https://bugzilla.suse.com/1262771","tags":["report"]},{"url":"https://bugzilla.suse.com/1262992","tags":["report"]},{"url":"https://bugzilla.suse.com/1262993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263008","tags":["report"]},{"url":"https://bugzilla.suse.com/1263010","tags":["report"]},{"url":"https://bugzilla.suse.com/1263011","tags":["report"]},{"url":"https://bugzilla.suse.com/1263013","tags":["report"]},{"url":"https://bugzilla.suse.com/1263014","tags":["report"]},{"url":"https://bugzilla.suse.com/1263016","tags":["report"]},{"url":"https://bugzilla.suse.com/1263017","tags":["report"]},{"url":"https://bugzilla.suse.com/1263020","tags":["report"]},{"url":"https://bugzilla.suse.com/1263025","tags":["report"]},{"url":"https://bugzilla.suse.com/1263030","tags":["report"]},{"url":"https://bugzilla.suse.com/1263031","tags":["report"]},{"url":"https://bugzilla.suse.com/1263045","tags":["report"]},{"url":"https://bugzilla.suse.com/1263055","tags":["report"]},{"url":"https://bugzilla.suse.com/1263059","tags":["report"]},{"url":"https://bugzilla.suse.com/1263061","tags":["report"]},{"url":"https://bugzilla.suse.com/1263065","tags":["report"]},{"url":"https://bugzilla.suse.com/1263073","tags":["report"]},{"url":"https://bugzilla.suse.com/1263075","tags":["report"]},{"url":"https://bugzilla.suse.com/1263097","tags":["report"]},{"url":"https://bugzilla.suse.com/1263111","tags":["report"]},{"url":"https://bugzilla.suse.com/1263122","tags":["report"]},{"url":"https://bugzilla.suse.com/1263123","tags":["report"]},{"url":"https://bugzilla.suse.com/1263124","tags":["report"]},{"url":"https://bugzilla.suse.com/1263128","tags":["report"]},{"url":"https://bugzilla.suse.com/1263130","tags":["report"]},{"url":"https://bugzilla.suse.com/1263134","tags":["report"]},{"url":"https://bugzilla.suse.com/1263139","tags":["report"]},{"url":"https://bugzilla.suse.com/1263142","tags":["report"]},{"url":"https://bugzilla.suse.com/1263145","tags":["report"]},{"url":"https://bugzilla.suse.com/1263152","tags":["report"]},{"url":"https://bugzilla.suse.com/1263167","tags":["report"]},{"url":"https://bugzilla.suse.com/1263170","tags":["report"]},{"url":"https://bugzilla.suse.com/1263173","tags":["report"]},{"url":"https://bugzilla.suse.com/1263175","tags":["report"]},{"url":"https://bugzilla.suse.com/1263491","tags":["report"]},{"url":"https://bugzilla.suse.com/1263493","tags":["report"]},{"url":"https://bugzilla.suse.com/1263495","tags":["report"]},{"url":"https://bugzilla.suse.com/1263539","tags":["report"]},{"url":"https://bugzilla.suse.com/1263560","tags":["report"]},{"url":"https://bugzilla.suse.com/1263588","tags":["report"]},{"url":"https://bugzilla.suse.com/1263591","tags":["report"]},{"url":"https://bugzilla.suse.com/1263598","tags":["report"]},{"url":"https://bugzilla.suse.com/1263600","tags":["report"]},{"url":"https://bugzilla.suse.com/1263657","tags":["report"]},{"url":"https://bugzilla.suse.com/1263718","tags":["report"]},{"url":"https://bugzilla.suse.com/1263723","tags":["report"]},{"url":"https://bugzilla.suse.com/1263776","tags":["report"]},{"url":"https://bugzilla.suse.com/1263777","tags":["report"]},{"url":"https://bugzilla.suse.com/1263778","tags":["report"]},{"url":"https://bugzilla.suse.com/1263780","tags":["report"]},{"url":"https://bugzilla.suse.com/1263782","tags":["report"]},{"url":"https://bugzilla.suse.com/1263785","tags":["report"]},{"url":"https://bugzilla.suse.com/1263786","tags":["report"]},{"url":"https://bugzilla.suse.com/1263788","tags":["report"]},{"url":"https://bugzilla.suse.com/1263790","tags":["report"]},{"url":"https://bugzilla.suse.com/1263797","tags":["report"]},{"url":"https://bugzilla.suse.com/1263806","tags":["report"]},{"url":"https://bugzilla.suse.com/1263876","tags":["report"]},{"url":"https://bugzilla.suse.com/1263879","tags":["report"]},{"url":"https://bugzilla.suse.com/1263880","tags":["report"]},{"url":"https://bugzilla.suse.com/1263904","tags":["report"]},{"url":"https://bugzilla.suse.com/1263905","tags":["report"]},{"url":"https://bugzilla.suse.com/1263911","tags":["report"]},{"url":"https://bugzilla.suse.com/1263917","tags":["report"]},{"url":"https://bugzilla.suse.com/1263918","tags":["report"]},{"url":"https://bugzilla.suse.com/1263919","tags":["report"]},{"url":"https://bugzilla.suse.com/1263921","tags":["report"]},{"url":"https://bugzilla.suse.com/1263923","tags":["report"]},{"url":"https://bugzilla.suse.com/1263945","tags":["report"]},{"url":"https://bugzilla.suse.com/1263975","tags":["report"]},{"url":"https://bugzilla.suse.com/1263999","tags":["report"]},{"url":"https://bugzilla.suse.com/1264003","tags":["report"]},{"url":"https://bugzilla.suse.com/1264006","tags":["report"]},{"url":"https://bugzilla.suse.com/1264008","tags":["report"]},{"url":"https://bugzilla.suse.com/1264009","tags":["report"]},{"url":"https://bugzilla.suse.com/1264013","tags":["report"]},{"url":"https://bugzilla.suse.com/1264019","tags":["report"]},{"url":"https://bugzilla.suse.com/1264030","tags":["report"]},{"url":"https://bugzilla.suse.com/1264032","tags":["report"]},{"url":"https://bugzilla.suse.com/1264033","tags":["report"]},{"url":"https://bugzilla.suse.com/1264035","tags":["report"]},{"url":"https://bugzilla.suse.com/1264039","tags":["report"]},{"url":"https://bugzilla.suse.com/1264041","tags":["report"]},{"url":"https://bugzilla.suse.com/1264044","tags":["report"]},{"url":"https://bugzilla.suse.com/1264048","tags":["report"]},{"url":"https://bugzilla.suse.com/1264053","tags":["report"]},{"url":"https://bugzilla.suse.com/1264065","tags":["report"]},{"url":"https://bugzilla.suse.com/1264070","tags":["report"]},{"url":"https://bugzilla.suse.com/1264071","tags":["report"]},{"url":"https://bugzilla.suse.com/1264073","tags":["report"]},{"url":"https://bugzilla.suse.com/1264074","tags":["report"]},{"url":"https://bugzilla.suse.com/1264075","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264079","tags":["report"]},{"url":"https://bugzilla.suse.com/1264080","tags":["report"]},{"url":"https://bugzilla.suse.com/1264084","tags":["report"]},{"url":"https://bugzilla.suse.com/1264087","tags":["report"]},{"url":"https://bugzilla.suse.com/1264088","tags":["report"]},{"url":"https://bugzilla.suse.com/1264089","tags":["report"]},{"url":"https://bugzilla.suse.com/1264090","tags":["report"]},{"url":"https://bugzilla.suse.com/1264093","tags":["report"]},{"url":"https://bugzilla.suse.com/1264100","tags":["report"]},{"url":"https://bugzilla.suse.com/1264101","tags":["report"]},{"url":"https://bugzilla.suse.com/1264110","tags":["report"]},{"url":"https://bugzilla.suse.com/1264116","tags":["report"]},{"url":"https://bugzilla.suse.com/1264117","tags":["report"]},{"url":"https://bugzilla.suse.com/1264121","tags":["report"]},{"url":"https://bugzilla.suse.com/1264122","tags":["report"]},{"url":"https://bugzilla.suse.com/1264124","tags":["report"]},{"url":"https://bugzilla.suse.com/1264125","tags":["report"]},{"url":"https://bugzilla.suse.com/1264129","tags":["report"]},{"url":"https://bugzilla.suse.com/1264137","tags":["report"]},{"url":"https://bugzilla.suse.com/1264142","tags":["report"]},{"url":"https://bugzilla.suse.com/1264184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264188","tags":["report"]},{"url":"https://bugzilla.suse.com/1264189","tags":["report"]},{"url":"https://bugzilla.suse.com/1264190","tags":["report"]},{"url":"https://bugzilla.suse.com/1264197","tags":["report"]},{"url":"https://bugzilla.suse.com/1264228","tags":["report"]},{"url":"https://bugzilla.suse.com/1264235","tags":["report"]},{"url":"https://bugzilla.suse.com/1264237","tags":["report"]},{"url":"https://bugzilla.suse.com/1264247","tags":["report"]},{"url":"https://bugzilla.suse.com/1264257","tags":["report"]},{"url":"https://bugzilla.suse.com/1264267","tags":["report"]},{"url":"https://bugzilla.suse.com/1264296","tags":["report"]},{"url":"https://bugzilla.suse.com/1264303","tags":["report"]},{"url":"https://bugzilla.suse.com/1264308","tags":["report"]},{"url":"https://bugzilla.suse.com/1264313","tags":["report"]},{"url":"https://bugzilla.suse.com/1264317","tags":["report"]},{"url":"https://bugzilla.suse.com/1264319","tags":["report"]},{"url":"https://bugzilla.suse.com/1264321","tags":["report"]},{"url":"https://bugzilla.suse.com/1264322","tags":["report"]},{"url":"https://bugzilla.suse.com/1264331","tags":["report"]},{"url":"https://bugzilla.suse.com/1264336","tags":["report"]},{"url":"https://bugzilla.suse.com/1264338","tags":["report"]},{"url":"https://bugzilla.suse.com/1264339","tags":["report"]},{"url":"https://bugzilla.suse.com/1264340","tags":["report"]},{"url":"https://bugzilla.suse.com/1264365","tags":["report"]},{"url":"https://bugzilla.suse.com/1264377","tags":["report"]},{"url":"https://bugzilla.suse.com/1264379","tags":["report"]},{"url":"https://bugzilla.suse.com/1264386","tags":["report"]},{"url":"https://bugzilla.suse.com/1264387","tags":["report"]},{"url":"https://bugzilla.suse.com/1264388","tags":["report"]},{"url":"https://bugzilla.suse.com/1264414","tags":["report"]},{"url":"https://bugzilla.suse.com/1264416","tags":["report"]},{"url":"https://bugzilla.suse.com/1264417","tags":["report"]},{"url":"https://bugzilla.suse.com/1264418","tags":["report"]},{"url":"https://bugzilla.suse.com/1264419","tags":["report"]},{"url":"https://bugzilla.suse.com/1264422","tags":["report"]},{"url":"https://bugzilla.suse.com/1264423","tags":["report"]},{"url":"https://bugzilla.suse.com/1264424","tags":["report"]},{"url":"https://bugzilla.suse.com/1264425","tags":["report"]},{"url":"https://bugzilla.suse.com/1264430","tags":["report"]},{"url":"https://bugzilla.suse.com/1264431","tags":["report"]},{"url":"https://bugzilla.suse.com/1264436","tags":["report"]},{"url":"https://bugzilla.suse.com/1264442","tags":["report"]},{"url":"https://bugzilla.suse.com/1264446","tags":["report"]},{"url":"https://bugzilla.suse.com/1264451","tags":["report"]},{"url":"https://bugzilla.suse.com/1264452","tags":["report"]},{"url":"https://bugzilla.suse.com/1264473","tags":["report"]},{"url":"https://bugzilla.suse.com/1264475","tags":["report"]},{"url":"https://bugzilla.suse.com/1264476","tags":["report"]},{"url":"https://bugzilla.suse.com/1264477","tags":["report"]},{"url":"https://bugzilla.suse.com/1264479","tags":["report"]},{"url":"https://bugzilla.suse.com/1264480","tags":["report"]},{"url":"https://bugzilla.suse.com/1264482","tags":["report"]},{"url":"https://bugzilla.suse.com/1264520","tags":["report"]},{"url":"https://bugzilla.suse.com/1264526","tags":["report"]},{"url":"https://bugzilla.suse.com/1264530","tags":["report"]},{"url":"https://bugzilla.suse.com/1264531","tags":["report"]},{"url":"https://bugzilla.suse.com/1264534","tags":["report"]},{"url":"https://bugzilla.suse.com/1264537","tags":["report"]},{"url":"https://bugzilla.suse.com/1264538","tags":["report"]},{"url":"https://bugzilla.suse.com/1264539","tags":["report"]},{"url":"https://bugzilla.suse.com/1264540","tags":["report"]},{"url":"https://bugzilla.suse.com/1264543","tags":["report"]},{"url":"https://bugzilla.suse.com/1264551","tags":["report"]},{"url":"https://bugzilla.suse.com/1264553","tags":["report"]},{"url":"https://bugzilla.suse.com/1264558","tags":["report"]},{"url":"https://bugzilla.suse.com/1264560","tags":["report"]},{"url":"https://bugzilla.suse.com/1264562","tags":["report"]},{"url":"https://bugzilla.suse.com/1264564","tags":["report"]},{"url":"https://bugzilla.suse.com/1264566","tags":["report"]},{"url":"https://bugzilla.suse.com/1264584","tags":["report"]},{"url":"https://bugzilla.suse.com/1264590","tags":["report"]},{"url":"https://bugzilla.suse.com/1264592","tags":["report"]},{"url":"https://bugzilla.suse.com/1264594","tags":["report"]},{"url":"https://bugzilla.suse.com/1264598","tags":["report"]},{"url":"https://bugzilla.suse.com/1264600","tags":["report"]},{"url":"https://bugzilla.suse.com/1264601","tags":["report"]},{"url":"https://bugzilla.suse.com/1264613","tags":["report"]},{"url":"https://bugzilla.suse.com/1264615","tags":["report"]},{"url":"https://bugzilla.suse.com/1264616","tags":["report"]},{"url":"https://bugzilla.suse.com/1264618","tags":["report"]},{"url":"https://bugzilla.suse.com/1264620","tags":["report"]},{"url":"https://bugzilla.suse.com/1264626","tags":["report"]},{"url":"https://bugzilla.suse.com/1264630","tags":["report"]},{"url":"https://bugzilla.suse.com/1264631","tags":["report"]},{"url":"https://bugzilla.suse.com/1264633","tags":["report"]},{"url":"https://bugzilla.suse.com/1264634","tags":["report"]},{"url":"https://bugzilla.suse.com/1264637","tags":["report"]},{"url":"https://bugzilla.suse.com/1264640","tags":["report"]},{"url":"https://bugzilla.suse.com/1264642","tags":["report"]},{"url":"https://bugzilla.suse.com/1264644","tags":["report"]},{"url":"https://bugzilla.suse.com/1264645","tags":["report"]},{"url":"https://bugzilla.suse.com/1264646","tags":["report"]},{"url":"https://bugzilla.suse.com/1264647","tags":["report"]},{"url":"https://bugzilla.suse.com/1264649","tags":["report"]},{"url":"https://bugzilla.suse.com/1264651","tags":["report"]},{"url":"https://bugzilla.suse.com/1264668","tags":["report"]},{"url":"https://bugzilla.suse.com/1264671","tags":["report"]},{"url":"https://bugzilla.suse.com/1264677","tags":["report"]},{"url":"https://bugzilla.suse.com/1264678","tags":["report"]},{"url":"https://bugzilla.suse.com/1264712","tags":["report"]},{"url":"https://bugzilla.suse.com/1264725","tags":["report"]},{"url":"https://bugzilla.suse.com/1264731","tags":["report"]},{"url":"https://bugzilla.suse.com/1264739","tags":["report"]},{"url":"https://bugzilla.suse.com/1264746","tags":["report"]},{"url":"https://bugzilla.suse.com/1264748","tags":["report"]},{"url":"https://bugzilla.suse.com/1264758","tags":["report"]},{"url":"https://bugzilla.suse.com/1264768","tags":["report"]},{"url":"https://bugzilla.suse.com/1264779","tags":["report"]},{"url":"https://bugzilla.suse.com/1264780","tags":["report"]},{"url":"https://bugzilla.suse.com/1264781","tags":["report"]},{"url":"https://bugzilla.suse.com/1264782","tags":["report"]},{"url":"https://bugzilla.suse.com/1264783","tags":["report"]},{"url":"https://bugzilla.suse.com/1264785","tags":["report"]},{"url":"https://bugzilla.suse.com/1264788","tags":["report"]},{"url":"https://bugzilla.suse.com/1264791","tags":["report"]},{"url":"https://bugzilla.suse.com/1264793","tags":["report"]},{"url":"https://bugzilla.suse.com/1264795","tags":["report"]},{"url":"https://bugzilla.suse.com/1264801","tags":["report"]},{"url":"https://bugzilla.suse.com/1264803","tags":["report"]},{"url":"https://bugzilla.suse.com/1264805","tags":["report"]},{"url":"https://bugzilla.suse.com/1264809","tags":["report"]},{"url":"https://bugzilla.suse.com/1264815","tags":["report"]},{"url":"https://bugzilla.suse.com/1264816","tags":["report"]},{"url":"https://bugzilla.suse.com/1264819","tags":["report"]},{"url":"https://bugzilla.suse.com/1264821","tags":["report"]},{"url":"https://bugzilla.suse.com/1264822","tags":["report"]},{"url":"https://bugzilla.suse.com/1264826","tags":["report"]},{"url":"https://bugzilla.suse.com/1264827","tags":["report"]},{"url":"https://bugzilla.suse.com/1264830","tags":["report"]},{"url":"https://bugzilla.suse.com/1264844","tags":["report"]},{"url":"https://bugzilla.suse.com/1264982","tags":["report"]},{"url":"https://bugzilla.suse.com/1264987","tags":["report"]},{"url":"https://bugzilla.suse.com/1264988","tags":["report"]},{"url":"https://bugzilla.suse.com/1264991","tags":["report"]},{"url":"https://bugzilla.suse.com/1264993","tags":["report"]},{"url":"https://bugzilla.suse.com/1265009","tags":["report"]},{"url":"https://bugzilla.suse.com/1265019","tags":["report"]},{"url":"https://bugzilla.suse.com/1265032","tags":["report"]},{"url":"https://bugzilla.suse.com/1265035","tags":["report"]},{"url":"https://bugzilla.suse.com/1265037","tags":["report"]},{"url":"https://bugzilla.suse.com/1265041","tags":["report"]},{"url":"https://bugzilla.suse.com/1265046","tags":["report"]},{"url":"https://bugzilla.suse.com/1265047","tags":["report"]},{"url":"https://bugzilla.suse.com/1265054","tags":["report"]},{"url":"https://bugzilla.suse.com/1265058","tags":["report"]},{"url":"https://bugzilla.suse.com/1265074","tags":["report"]},{"url":"https://bugzilla.suse.com/1265078","tags":["report"]},{"url":"https://bugzilla.suse.com/1265080","tags":["report"]},{"url":"https://bugzilla.suse.com/1265086","tags":["report"]},{"url":"https://bugzilla.suse.com/1265089","tags":["report"]},{"url":"https://bugzilla.suse.com/1265090","tags":["report"]},{"url":"https://bugzilla.suse.com/1265092","tags":["report"]},{"url":"https://bugzilla.suse.com/1265093","tags":["report"]},{"url":"https://bugzilla.suse.com/1265096","tags":["report"]},{"url":"https://bugzilla.suse.com/1265100","tags":["report"]},{"url":"https://bugzilla.suse.com/1265101","tags":["report"]},{"url":"https://bugzilla.suse.com/1265102","tags":["report"]},{"url":"https://bugzilla.suse.com/1265105","tags":["report"]},{"url":"https://bugzilla.suse.com/1265122","tags":["report"]},{"url":"https://bugzilla.suse.com/1265126","tags":["report"]},{"url":"https://bugzilla.suse.com/1265133","tags":["report"]},{"url":"https://bugzilla.suse.com/1265138","tags":["report"]},{"url":"https://bugzilla.suse.com/1265144","tags":["report"]},{"url":"https://bugzilla.suse.com/1265240","tags":["report"]},{"url":"https://bugzilla.suse.com/1265247","tags":["report"]},{"url":"https://bugzilla.suse.com/1265249","tags":["report"]},{"url":"https://bugzilla.suse.com/1265251","tags":["report"]},{"url":"https://bugzilla.suse.com/1265254","tags":["report"]},{"url":"https://bugzilla.suse.com/1265257","tags":["report"]},{"url":"https://bugzilla.suse.com/1265264","tags":["report"]},{"url":"https://bugzilla.suse.com/1265449","tags":["report"]},{"url":"https://bugzilla.suse.com/1265627","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1265999","tags":["report"]},{"url":"https://bugzilla.suse.com/1266000","tags":["report"]},{"url":"https://bugzilla.suse.com/1266009","tags":["report"]},{"url":"https://bugzilla.suse.com/1266393","tags":["report"]},{"url":"https://bugzilla.suse.com/1266399","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266411","tags":["report"]},{"url":"https://bugzilla.suse.com/1266412","tags":["report"]},{"url":"https://bugzilla.suse.com/1266467","tags":["report"]},{"url":"https://bugzilla.suse.com/1266468","tags":["report"]},{"url":"https://bugzilla.suse.com/1266470","tags":["report"]},{"url":"https://bugzilla.suse.com/1266677","tags":["report"]},{"url":"https://bugzilla.suse.com/1266679","tags":["report"]},{"url":"https://bugzilla.suse.com/1266684","tags":["report"]},{"url":"https://bugzilla.suse.com/1266685","tags":["report"]},{"url":"https://bugzilla.suse.com/1266688","tags":["report"]},{"url":"https://bugzilla.suse.com/1266690","tags":["report"]},{"url":"https://bugzilla.suse.com/1266692","tags":["report"]},{"url":"https://bugzilla.suse.com/1266694","tags":["report"]},{"url":"https://bugzilla.suse.com/1266695","tags":["report"]},{"url":"https://bugzilla.suse.com/1266703","tags":["report"]},{"url":"https://bugzilla.suse.com/1266706","tags":["report"]},{"url":"https://bugzilla.suse.com/1266707","tags":["report"]},{"url":"https://bugzilla.suse.com/1266712","tags":["report"]},{"url":"https://bugzilla.suse.com/1266714","tags":["report"]},{"url":"https://bugzilla.suse.com/1266715","tags":["report"]},{"url":"https://bugzilla.suse.com/1266716","tags":["report"]},{"url":"https://bugzilla.suse.com/1266721","tags":["report"]},{"url":"https://bugzilla.suse.com/1266729","tags":["report"]},{"url":"https://bugzilla.suse.com/1266730","tags":["report"]},{"url":"https://bugzilla.suse.com/1266732","tags":["report"]},{"url":"https://bugzilla.suse.com/1266735","tags":["report"]},{"url":"https://bugzilla.suse.com/1266736","tags":["report"]},{"url":"https://bugzilla.suse.com/1266739","tags":["report"]},{"url":"https://bugzilla.suse.com/1266741","tags":["report"]},{"url":"https://bugzilla.suse.com/1266743","tags":["report"]},{"url":"https://bugzilla.suse.com/1266744","tags":["report"]},{"url":"https://bugzilla.suse.com/1266751","tags":["report"]},{"url":"https://bugzilla.suse.com/1266755","tags":["report"]},{"url":"https://bugzilla.suse.com/1266757","tags":["report"]},{"url":"https://bugzilla.suse.com/1266758","tags":["report"]},{"url":"https://bugzilla.suse.com/1266762","tags":["report"]},{"url":"https://bugzilla.suse.com/1266767","tags":["report"]},{"url":"https://bugzilla.suse.com/1266774","tags":["report"]},{"url":"https://bugzilla.suse.com/1266775","tags":["report"]},{"url":"https://bugzilla.suse.com/1266780","tags":["report"]},{"url":"https://bugzilla.suse.com/1266806","tags":["report"]},{"url":"https://bugzilla.suse.com/1266813","tags":["report"]},{"url":"https://bugzilla.suse.com/1266831","tags":["report"]},{"url":"https://bugzilla.suse.com/1266832","tags":["report"]},{"url":"https://bugzilla.suse.com/1266834","tags":["report"]},{"url":"https://bugzilla.suse.com/1266835","tags":["report"]},{"url":"https://bugzilla.suse.com/1266836","tags":["report"]},{"url":"https://bugzilla.suse.com/1266839","tags":["report"]},{"url":"https://bugzilla.suse.com/1266841","tags":["report"]},{"url":"https://bugzilla.suse.com/1266842","tags":["report"]},{"url":"https://bugzilla.suse.com/1266846","tags":["report"]},{"url":"https://bugzilla.suse.com/1266850","tags":["report"]},{"url":"https://bugzilla.suse.com/1266854","tags":["report"]},{"url":"https://bugzilla.suse.com/1266855","tags":["report"]},{"url":"https://bugzilla.suse.com/1266858","tags":["report"]},{"url":"https://bugzilla.suse.com/1266863","tags":["report"]},{"url":"https://bugzilla.suse.com/1266864","tags":["report"]},{"url":"https://bugzilla.suse.com/1266869","tags":["report"]},{"url":"https://bugzilla.suse.com/1266870","tags":["report"]},{"url":"https://bugzilla.suse.com/1266872","tags":["report"]},{"url":"https://bugzilla.suse.com/1266876","tags":["report"]},{"url":"https://bugzilla.suse.com/1266879","tags":["report"]},{"url":"https://bugzilla.suse.com/1266880","tags":["report"]},{"url":"https://bugzilla.suse.com/1266882","tags":["report"]},{"url":"https://bugzilla.suse.com/1266886","tags":["report"]},{"url":"https://bugzilla.suse.com/1266890","tags":["report"]},{"url":"https://bugzilla.suse.com/1266891","tags":["report"]},{"url":"https://bugzilla.suse.com/1266894","tags":["report"]},{"url":"https://bugzilla.suse.com/1266896","tags":["report"]},{"url":"https://bugzilla.suse.com/1266898","tags":["report"]},{"url":"https://bugzilla.suse.com/1266900","tags":["report"]},{"url":"https://bugzilla.suse.com/1266904","tags":["report"]},{"url":"https://bugzilla.suse.com/1266908","tags":["report"]},{"url":"https://bugzilla.suse.com/1266910","tags":["report"]},{"url":"https://bugzilla.suse.com/1266913","tags":["report"]},{"url":"https://bugzilla.suse.com/1266917","tags":["report"]},{"url":"https://bugzilla.suse.com/1266918","tags":["report"]},{"url":"https://bugzilla.suse.com/1266920","tags":["report"]},{"url":"https://bugzilla.suse.com/1266930","tags":["report"]},{"url":"https://bugzilla.suse.com/1266931","tags":["report"]},{"url":"https://bugzilla.suse.com/1266932","tags":["report"]},{"url":"https://bugzilla.suse.com/1266934","tags":["report"]},{"url":"https://bugzilla.suse.com/1266935","tags":["report"]},{"url":"https://bugzilla.suse.com/1266939","tags":["report"]},{"url":"https://bugzilla.suse.com/1266947","tags":["report"]},{"url":"https://bugzilla.suse.com/1266969","tags":["report"]},{"url":"https://bugzilla.suse.com/1267021","tags":["report"]},{"url":"https://bugzilla.suse.com/1267025","tags":["report"]},{"url":"https://bugzilla.suse.com/1267027","tags":["report"]},{"url":"https://bugzilla.suse.com/1267198","tags":["report"]},{"url":"https://bugzilla.suse.com/1267203","tags":["report"]},{"url":"https://bugzilla.suse.com/1267204","tags":["report"]},{"url":"https://bugzilla.suse.com/1267209","tags":["report"]},{"url":"https://bugzilla.suse.com/1267210","tags":["report"]},{"url":"https://bugzilla.suse.com/1267213","tags":["report"]},{"url":"https://bugzilla.suse.com/1267222","tags":["report"]},{"url":"https://bugzilla.suse.com/1267226","tags":["report"]},{"url":"https://bugzilla.suse.com/1267234","tags":["report"]},{"url":"https://bugzilla.suse.com/1267236","tags":["report"]},{"url":"https://bugzilla.suse.com/1267251","tags":["report"]},{"url":"https://bugzilla.suse.com/1267367","tags":["report"]},{"url":"https://bugzilla.suse.com/1267371","tags":["report"]},{"url":"https://bugzilla.suse.com/1267375","tags":["report"]},{"url":"https://bugzilla.suse.com/1267380","tags":["report"]},{"url":"https://bugzilla.suse.com/1267381","tags":["report"]},{"url":"https://bugzilla.suse.com/1267384","tags":["report"]},{"url":"https://bugzilla.suse.com/1267419","tags":["report"]},{"url":"https://bugzilla.suse.com/1267432","tags":["report"]},{"url":"https://bugzilla.suse.com/1267435","tags":["report"]},{"url":"https://bugzilla.suse.com/1267436","tags":["report"]},{"url":"https://bugzilla.suse.com/1267439","tags":["report"]},{"url":"https://bugzilla.suse.com/1267445","tags":["report"]},{"url":"https://bugzilla.suse.com/1267448","tags":["report"]},{"url":"https://bugzilla.suse.com/1267449","tags":["report"]},{"url":"https://bugzilla.suse.com/1267466","tags":["report"]},{"url":"https://bugzilla.suse.com/1267468","tags":["report"]},{"url":"https://bugzilla.suse.com/1267470","tags":["report"]},{"url":"https://bugzilla.suse.com/1267472","tags":["report"]},{"url":"https://bugzilla.suse.com/1267473","tags":["report"]},{"url":"https://bugzilla.suse.com/1267479","tags":["report"]},{"url":"https://bugzilla.suse.com/1267491","tags":["report"]},{"url":"https://bugzilla.suse.com/1267495","tags":["report"]},{"url":"https://bugzilla.suse.com/1267496","tags":["report"]},{"url":"https://bugzilla.suse.com/1267497","tags":["report"]},{"url":"https://bugzilla.suse.com/1267502","tags":["report"]},{"url":"https://bugzilla.suse.com/1267524","tags":["report"]},{"url":"https://bugzilla.suse.com/1267555","tags":["report"]},{"url":"https://bugzilla.suse.com/1267565","tags":["report"]},{"url":"https://bugzilla.suse.com/1267567","tags":["report"]},{"url":"https://bugzilla.suse.com/1267570","tags":["report"]},{"url":"https://bugzilla.suse.com/1267571","tags":["report"]},{"url":"https://bugzilla.suse.com/1267583","tags":["report"]},{"url":"https://bugzilla.suse.com/1267584","tags":["report"]},{"url":"https://bugzilla.suse.com/1267592","tags":["report"]},{"url":"https://bugzilla.suse.com/1267594","tags":["report"]},{"url":"https://bugzilla.suse.com/1267595","tags":["report"]},{"url":"https://bugzilla.suse.com/1267596","tags":["report"]},{"url":"https://bugzilla.suse.com/1267597","tags":["report"]},{"url":"https://bugzilla.suse.com/1267600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267611","tags":["report"]},{"url":"https://bugzilla.suse.com/1267615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267616","tags":["report"]},{"url":"https://bugzilla.suse.com/1267621","tags":["report"]},{"url":"https://bugzilla.suse.com/1267623","tags":["report"]},{"url":"https://bugzilla.suse.com/1267627","tags":["report"]},{"url":"https://bugzilla.suse.com/1267629","tags":["report"]},{"url":"https://bugzilla.suse.com/1267630","tags":["report"]},{"url":"https://bugzilla.suse.com/1267632","tags":["report"]},{"url":"https://bugzilla.suse.com/1267636","tags":["report"]},{"url":"https://bugzilla.suse.com/1267638","tags":["report"]},{"url":"https://bugzilla.suse.com/1267643","tags":["report"]},{"url":"https://bugzilla.suse.com/1267646","tags":["report"]},{"url":"https://bugzilla.suse.com/1267648","tags":["report"]},{"url":"https://bugzilla.suse.com/1267649","tags":["report"]},{"url":"https://bugzilla.suse.com/1267651","tags":["report"]},{"url":"https://bugzilla.suse.com/1267656","tags":["report"]},{"url":"https://bugzilla.suse.com/1267657","tags":["report"]},{"url":"https://bugzilla.suse.com/1267658","tags":["report"]},{"url":"https://bugzilla.suse.com/1267659","tags":["report"]},{"url":"https://bugzilla.suse.com/1267661","tags":["report"]},{"url":"https://bugzilla.suse.com/1267662","tags":["report"]},{"url":"https://bugzilla.suse.com/1267663","tags":["report"]},{"url":"https://bugzilla.suse.com/1267666","tags":["report"]},{"url":"https://bugzilla.suse.com/1267667","tags":["report"]},{"url":"https://bugzilla.suse.com/1267669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267673","tags":["report"]},{"url":"https://bugzilla.suse.com/1267676","tags":["report"]},{"url":"https://bugzilla.suse.com/1267677","tags":["report"]},{"url":"https://bugzilla.suse.com/1267678","tags":["report"]},{"url":"https://bugzilla.suse.com/1267680","tags":["report"]},{"url":"https://bugzilla.suse.com/1267682","tags":["report"]},{"url":"https://bugzilla.suse.com/1267683","tags":["report"]},{"url":"https://bugzilla.suse.com/1267689","tags":["report"]},{"url":"https://bugzilla.suse.com/1267690","tags":["report"]},{"url":"https://bugzilla.suse.com/1267691","tags":["report"]},{"url":"https://bugzilla.suse.com/1267693","tags":["report"]},{"url":"https://bugzilla.suse.com/1267701","tags":["report"]},{"url":"https://bugzilla.suse.com/1267702","tags":["report"]},{"url":"https://bugzilla.suse.com/1267704","tags":["report"]},{"url":"https://bugzilla.suse.com/1267712","tags":["report"]},{"url":"https://bugzilla.suse.com/1267714","tags":["report"]},{"url":"https://bugzilla.suse.com/1267715","tags":["report"]},{"url":"https://bugzilla.suse.com/1267719","tags":["report"]},{"url":"https://bugzilla.suse.com/1267725","tags":["report"]},{"url":"https://bugzilla.suse.com/1267726","tags":["report"]},{"url":"https://bugzilla.suse.com/1267728","tags":["report"]},{"url":"https://bugzilla.suse.com/1267738","tags":["report"]},{"url":"https://bugzilla.suse.com/1267918","tags":["report"]},{"url":"https://bugzilla.suse.com/1267919","tags":["report"]},{"url":"https://bugzilla.suse.com/1267922","tags":["report"]},{"url":"https://bugzilla.suse.com/1267927","tags":["report"]},{"url":"https://bugzilla.suse.com/1267932","tags":["report"]},{"url":"https://bugzilla.suse.com/1267939","tags":["report"]},{"url":"https://bugzilla.suse.com/1267943","tags":["report"]},{"url":"https://bugzilla.suse.com/1267948","tags":["report"]},{"url":"https://bugzilla.suse.com/1267952","tags":["report"]},{"url":"https://bugzilla.suse.com/1267953","tags":["report"]},{"url":"https://bugzilla.suse.com/1267954","tags":["report"]},{"url":"https://bugzilla.suse.com/1267968","tags":["report"]},{"url":"https://bugzilla.suse.com/1267983","tags":["report"]},{"url":"https://bugzilla.suse.com/1267986","tags":["report"]},{"url":"https://bugzilla.suse.com/1267987","tags":["report"]},{"url":"https://bugzilla.suse.com/1267990","tags":["report"]},{"url":"https://bugzilla.suse.com/1267991","tags":["report"]},{"url":"https://bugzilla.suse.com/1267995","tags":["report"]},{"url":"https://bugzilla.suse.com/1268024","tags":["report"]},{"url":"https://bugzilla.suse.com/1268029","tags":["report"]},{"url":"https://bugzilla.suse.com/1268030","tags":["report"]},{"url":"https://bugzilla.suse.com/1268031","tags":["report"]},{"url":"https://bugzilla.suse.com/1268038","tags":["report"]},{"url":"https://bugzilla.suse.com/1268051","tags":["report"]},{"url":"https://bugzilla.suse.com/1268220","tags":["report"]},{"url":"https://bugzilla.suse.com/1268221","tags":["report"]},{"url":"https://bugzilla.suse.com/1268222","tags":["report"]},{"url":"https://bugzilla.suse.com/1268223","tags":["report"]},{"url":"https://bugzilla.suse.com/1268307","tags":["report"]},{"url":"https://bugzilla.suse.com/1268659","tags":["report"]},{"url":"https://bugzilla.suse.com/1268966","tags":["report"]},{"url":"https://bugzilla.suse.com/1268967","tags":["report"]},{"url":"https://bugzilla.suse.com/1268981","tags":["report"]},{"url":"https://bugzilla.suse.com/1268983","tags":["report"]},{"url":"https://bugzilla.suse.com/1268985","tags":["report"]},{"url":"https://bugzilla.suse.com/1268987","tags":["report"]},{"url":"https://bugzilla.suse.com/1268994","tags":["report"]},{"url":"https://bugzilla.suse.com/1269001","tags":["report"]},{"url":"https://bugzilla.suse.com/1269002","tags":["report"]},{"url":"https://bugzilla.suse.com/1269003","tags":["report"]},{"url":"https://bugzilla.suse.com/1269024","tags":["report"]},{"url":"https://bugzilla.suse.com/1269025","tags":["report"]},{"url":"https://bugzilla.suse.com/1269027","tags":["report"]},{"url":"https://bugzilla.suse.com/1269030","tags":["report"]},{"url":"https://bugzilla.suse.com/1269081","tags":["report"]},{"url":"https://bugzilla.suse.com/1269090","tags":["report"]},{"url":"https://bugzilla.suse.com/1269092","tags":["report"]},{"url":"https://bugzilla.suse.com/1269094","tags":["report"]},{"url":"https://bugzilla.suse.com/1269095","tags":["report"]},{"url":"https://bugzilla.suse.com/1269098","tags":["report"]},{"url":"https://bugzilla.suse.com/1269100","tags":["report"]},{"url":"https://bugzilla.suse.com/1269104","tags":["report"]},{"url":"https://bugzilla.suse.com/1269106","tags":["report"]},{"url":"https://bugzilla.suse.com/1269107","tags":["report"]},{"url":"https://bugzilla.suse.com/1269111","tags":["report"]},{"url":"https://bugzilla.suse.com/1269112","tags":["report"]},{"url":"https://bugzilla.suse.com/1269115","tags":["report"]},{"url":"https://bugzilla.suse.com/1269116","tags":["report"]},{"url":"https://bugzilla.suse.com/1269117","tags":["report"]},{"url":"https://bugzilla.suse.com/1269118","tags":["report"]},{"url":"https://bugzilla.suse.com/1269119","tags":["report"]},{"url":"https://bugzilla.suse.com/1269124","tags":["report"]},{"url":"https://bugzilla.suse.com/1269125","tags":["report"]},{"url":"https://bugzilla.suse.com/1269131","tags":["report"]},{"url":"https://bugzilla.suse.com/1269132","tags":["report"]},{"url":"https://bugzilla.suse.com/1269133","tags":["report"]},{"url":"https://bugzilla.suse.com/1269138","tags":["report"]},{"url":"https://bugzilla.suse.com/1269141","tags":["report"]},{"url":"https://bugzilla.suse.com/1269153","tags":["report"]},{"url":"https://bugzilla.suse.com/1269154","tags":["report"]},{"url":"https://bugzilla.suse.com/1269157","tags":["report"]},{"url":"https://bugzilla.suse.com/1269158","tags":["report"]},{"url":"https://bugzilla.suse.com/1269166","tags":["report"]},{"url":"https://bugzilla.suse.com/1269170","tags":["report"]},{"url":"https://bugzilla.suse.com/1269172","tags":["report"]},{"url":"https://bugzilla.suse.com/1269174","tags":["report"]},{"url":"https://bugzilla.suse.com/1269175","tags":["report"]},{"url":"https://bugzilla.suse.com/1269177","tags":["report"]},{"url":"https://bugzilla.suse.com/1269178","tags":["report"]},{"url":"https://bugzilla.suse.com/1269181","tags":["report"]},{"url":"https://bugzilla.suse.com/1269184","tags":["report"]},{"url":"https://bugzilla.suse.com/1269185","tags":["report"]},{"url":"https://bugzilla.suse.com/1269186","tags":["report"]},{"url":"https://bugzilla.suse.com/1269187","tags":["report"]},{"url":"https://bugzilla.suse.com/1269190","tags":["report"]},{"url":"https://bugzilla.suse.com/1269195","tags":["report"]},{"url":"https://bugzilla.suse.com/1269198","tags":["report"]},{"url":"https://bugzilla.suse.com/1269227","tags":["report"]},{"url":"https://bugzilla.suse.com/1269229","tags":["report"]},{"url":"https://bugzilla.suse.com/1269232","tags":["report"]},{"url":"https://bugzilla.suse.com/1269233","tags":["report"]},{"url":"https://bugzilla.suse.com/1269235","tags":["report"]},{"url":"https://bugzilla.suse.com/1269236","tags":["report"]},{"url":"https://bugzilla.suse.com/1269239","tags":["report"]},{"url":"https://bugzilla.suse.com/1269240","tags":["report"]},{"url":"https://bugzilla.suse.com/1269241","tags":["report"]},{"url":"https://bugzilla.suse.com/1269244","tags":["report"]},{"url":"https://bugzilla.suse.com/1269245","tags":["report"]},{"url":"https://bugzilla.suse.com/1269254","tags":["report"]},{"url":"https://bugzilla.suse.com/1269255","tags":["report"]},{"url":"https://bugzilla.suse.com/1269257","tags":["report"]},{"url":"https://bugzilla.suse.com/1269258","tags":["report"]},{"url":"https://bugzilla.suse.com/1269270","tags":["report"]},{"url":"https://bugzilla.suse.com/1269272","tags":["report"]},{"url":"https://bugzilla.suse.com/1269273","tags":["report"]},{"url":"https://bugzilla.suse.com/1269281","tags":["report"]},{"url":"https://bugzilla.suse.com/1269283","tags":["report"]},{"url":"https://bugzilla.suse.com/1269286","tags":["report"]},{"url":"https://bugzilla.suse.com/1269289","tags":["report"]},{"url":"https://bugzilla.suse.com/1269290","tags":["report"]},{"url":"https://bugzilla.suse.com/1269304","tags":["report"]},{"url":"https://bugzilla.suse.com/1269307","tags":["report"]},{"url":"https://bugzilla.suse.com/1269314","tags":["report"]},{"url":"https://bugzilla.suse.com/1269318","tags":["report"]},{"url":"https://bugzilla.suse.com/1269337","tags":["report"]},{"url":"https://bugzilla.suse.com/1269362","tags":["report"]},{"url":"https://bugzilla.suse.com/1269364","tags":["report"]},{"url":"https://bugzilla.suse.com/1269376","tags":["report"]},{"url":"https://bugzilla.suse.com/1269378","tags":["report"]},{"url":"https://bugzilla.suse.com/1269383","tags":["report"]},{"url":"https://bugzilla.suse.com/1269385","tags":["report"]},{"url":"https://bugzilla.suse.com/1269386","tags":["report"]},{"url":"https://bugzilla.suse.com/1269391","tags":["report"]},{"url":"https://bugzilla.suse.com/1269403","tags":["report"]},{"url":"https://bugzilla.suse.com/1269404","tags":["report"]},{"url":"https://bugzilla.suse.com/1269410","tags":["report"]},{"url":"https://bugzilla.suse.com/1269414","tags":["report"]},{"url":"https://bugzilla.suse.com/1269415","tags":["report"]},{"url":"https://bugzilla.suse.com/1269505","tags":["report"]},{"url":"https://bugzilla.suse.com/1269511","tags":["report"]},{"url":"https://bugzilla.suse.com/1269512","tags":["report"]},{"url":"https://bugzilla.suse.com/1269513","tags":["report"]},{"url":"https://bugzilla.suse.com/1269556","tags":["report"]},{"url":"https://bugzilla.suse.com/1269557","tags":["report"]},{"url":"https://bugzilla.suse.com/1269574","tags":["report"]},{"url":"https://bugzilla.suse.com/1269577","tags":["report"]},{"url":"https://bugzilla.suse.com/1269588","tags":["report"]},{"url":"https://bugzilla.suse.com/1269637","tags":["report"]},{"url":"https://bugzilla.suse.com/1269643","tags":["report"]},{"url":"https://bugzilla.suse.com/1269644","tags":["report"]},{"url":"https://bugzilla.suse.com/1269652","tags":["report"]},{"url":"https://bugzilla.suse.com/1269654","tags":["report"]},{"url":"https://bugzilla.suse.com/1269658","tags":["report"]},{"url":"https://bugzilla.suse.com/1269659","tags":["report"]},{"url":"https://bugzilla.suse.com/1269660","tags":["report"]},{"url":"https://bugzilla.suse.com/1269661","tags":["report"]},{"url":"https://bugzilla.suse.com/1269663","tags":["report"]},{"url":"https://bugzilla.suse.com/1269669","tags":["report"]},{"url":"https://bugzilla.suse.com/1269670","tags":["report"]},{"url":"https://bugzilla.suse.com/1269672","tags":["report"]},{"url":"https://bugzilla.suse.com/1269674","tags":["report"]},{"url":"https://bugzilla.suse.com/1269675","tags":["report"]},{"url":"https://bugzilla.suse.com/1269677","tags":["report"]},{"url":"https://bugzilla.suse.com/1269678","tags":["report"]},{"url":"https://bugzilla.suse.com/1269681","tags":["report"]},{"url":"https://bugzilla.suse.com/1269682","tags":["report"]},{"url":"https://bugzilla.suse.com/1269684","tags":["report"]},{"url":"https://bugzilla.suse.com/1269687","tags":["report"]},{"url":"https://bugzilla.suse.com/1269688","tags":["report"]},{"url":"https://bugzilla.suse.com/1269689","tags":["report"]},{"url":"https://bugzilla.suse.com/1269694","tags":["report"]},{"url":"https://bugzilla.suse.com/1269709","tags":["report"]},{"url":"https://bugzilla.suse.com/1269711","tags":["report"]},{"url":"https://bugzilla.suse.com/1269712","tags":["report"]},{"url":"https://bugzilla.suse.com/1269713","tags":["report"]},{"url":"https://bugzilla.suse.com/1269714","tags":["report"]},{"url":"https://bugzilla.suse.com/1269719","tags":["report"]},{"url":"https://bugzilla.suse.com/1269722","tags":["report"]},{"url":"https://bugzilla.suse.com/1269724","tags":["report"]},{"url":"https://bugzilla.suse.com/1269726","tags":["report"]},{"url":"https://bugzilla.suse.com/1269727","tags":["report"]},{"url":"https://bugzilla.suse.com/1269731","tags":["report"]},{"url":"https://bugzilla.suse.com/1269733","tags":["report"]},{"url":"https://bugzilla.suse.com/1269734","tags":["report"]},{"url":"https://bugzilla.suse.com/1269770","tags":["report"]},{"url":"https://bugzilla.suse.com/1269772","tags":["report"]},{"url":"https://bugzilla.suse.com/1269773","tags":["report"]},{"url":"https://bugzilla.suse.com/1269786","tags":["report"]},{"url":"https://bugzilla.suse.com/1269796","tags":["report"]},{"url":"https://bugzilla.suse.com/1269797","tags":["report"]},{"url":"https://bugzilla.suse.com/1269799","tags":["report"]},{"url":"https://bugzilla.suse.com/1269801","tags":["report"]},{"url":"https://bugzilla.suse.com/1269808","tags":["report"]},{"url":"https://bugzilla.suse.com/1269810","tags":["report"]},{"url":"https://bugzilla.suse.com/1269811","tags":["report"]},{"url":"https://bugzilla.suse.com/1269817","tags":["report"]},{"url":"https://bugzilla.suse.com/1269819","tags":["report"]},{"url":"https://bugzilla.suse.com/1269826","tags":["report"]},{"url":"https://bugzilla.suse.com/1269877","tags":["report"]},{"url":"https://bugzilla.suse.com/1269879","tags":["report"]},{"url":"https://bugzilla.suse.com/1269884","tags":["report"]},{"url":"https://bugzilla.suse.com/1269886","tags":["report"]},{"url":"https://bugzilla.suse.com/1269889","tags":["report"]},{"url":"https://bugzilla.suse.com/1269898","tags":["report"]},{"url":"https://bugzilla.suse.com/1269899","tags":["report"]},{"url":"https://bugzilla.suse.com/1269902","tags":["report"]},{"url":"https://bugzilla.suse.com/1269950","tags":["report"]},{"url":"https://bugzilla.suse.com/1269961","tags":["report"]},{"url":"https://bugzilla.suse.com/1269964","tags":["report"]},{"url":"https://bugzilla.suse.com/1269973","tags":["report"]},{"url":"https://bugzilla.suse.com/1269976","tags":["report"]},{"url":"https://bugzilla.suse.com/1269979","tags":["report"]},{"url":"https://bugzilla.suse.com/1269984","tags":["report"]},{"url":"https://bugzilla.suse.com/1269986","tags":["report"]},{"url":"https://bugzilla.suse.com/1269988","tags":["report"]},{"url":"https://bugzilla.suse.com/1269990","tags":["report"]},{"url":"https://bugzilla.suse.com/1269991","tags":["report"]},{"url":"https://bugzilla.suse.com/1269993","tags":["report"]},{"url":"https://bugzilla.suse.com/1269994","tags":["report"]},{"url":"https://bugzilla.suse.com/1269995","tags":["report"]},{"url":"https://bugzilla.suse.com/1269996","tags":["report"]},{"url":"https://bugzilla.suse.com/1269997","tags":["report"]},{"url":"https://bugzilla.suse.com/1269998","tags":["report"]},{"url":"https://bugzilla.suse.com/1270058","tags":["report"]},{"url":"https://bugzilla.suse.com/1270059","tags":["report"]},{"url":"https://bugzilla.suse.com/1270102","tags":["report"]},{"url":"https://bugzilla.suse.com/1270112","tags":["report"]},{"url":"https://bugzilla.suse.com/1270113","tags":["report"]},{"url":"https://bugzilla.suse.com/1270132","tags":["report"]},{"url":"https://bugzilla.suse.com/1270241","tags":["report"]},{"url":"https://bugzilla.suse.com/1270244","tags":["report"]},{"url":"https://bugzilla.suse.com/1270248","tags":["report"]},{"url":"https://bugzilla.suse.com/1270249","tags":["report"]},{"url":"https://bugzilla.suse.com/1270257","tags":["report"]},{"url":"https://bugzilla.suse.com/1270260","tags":["report"]},{"url":"https://bugzilla.suse.com/1270302","tags":["report"]},{"url":"https://bugzilla.suse.com/1271290","tags":["report"]},{"url":"https://bugzilla.suse.com/1271291","tags":["report"]},{"url":"https://bugzilla.suse.com/1271349","tags":["report"]},{"url":"https://bugzilla.suse.com/1271366","tags":["report"]},{"url":"https://bugzilla.suse.com/1271368","tags":["report"]},{"url":"https://bugzilla.suse.com/1271395","tags":["report"]},{"url":"https://bugzilla.suse.com/1271526","tags":["report"]},{"url":"https://bugzilla.suse.com/1271717","tags":["report"]},{"url":"https://bugzilla.suse.com/1271731","tags":["report"]},{"url":"https://bugzilla.suse.com/1271813","tags":["report"]},{"url":"https://bugzilla.suse.com/1271818","tags":["report"]},{"url":"https://bugzilla.suse.com/1271820","tags":["report"]},{"url":"https://bugzilla.suse.com/1271825","tags":["report"]},{"url":"https://bugzilla.suse.com/1271826","tags":["report"]},{"url":"https://bugzilla.suse.com/1271827","tags":["report"]},{"url":"https://bugzilla.suse.com/1271830","tags":["report"]},{"url":"https://bugzilla.suse.com/1271831","tags":["report"]},{"url":"https://bugzilla.suse.com/1271832","tags":["report"]},{"url":"https://bugzilla.suse.com/1271833","tags":["report"]},{"url":"https://bugzilla.suse.com/1271834","tags":["report"]},{"url":"https://bugzilla.suse.com/1271835","tags":["report"]},{"url":"https://bugzilla.suse.com/1271858","tags":["report"]},{"url":"https://bugzilla.suse.com/1271859","tags":["report"]},{"url":"https://bugzilla.suse.com/1271866","tags":["report"]},{"url":"https://bugzilla.suse.com/1271869","tags":["report"]},{"url":"https://bugzilla.suse.com/1271870","tags":["report"]},{"url":"https://bugzilla.suse.com/1271899","tags":["report"]},{"url":"https://bugzilla.suse.com/1271904","tags":["report"]},{"url":"https://bugzilla.suse.com/1271906","tags":["report"]},{"url":"https://bugzilla.suse.com/1271908","tags":["report"]},{"url":"https://bugzilla.suse.com/1271912","tags":["report"]},{"url":"https://bugzilla.suse.com/1271937","tags":["report"]},{"url":"https://bugzilla.suse.com/1271955","tags":["report"]},{"url":"https://bugzilla.suse.com/1271964","tags":["report"]},{"url":"https://bugzilla.suse.com/1271967","tags":["report"]},{"url":"https://bugzilla.suse.com/1272146","tags":["report"]},{"url":"https://bugzilla.suse.com/1272150","tags":["report"]},{"url":"https://bugzilla.suse.com/1272176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272179","tags":["report"]},{"url":"https://bugzilla.suse.com/1272180","tags":["report"]},{"url":"https://bugzilla.suse.com/1272183","tags":["report"]},{"url":"https://bugzilla.suse.com/1272184","tags":["report"]},{"url":"https://bugzilla.suse.com/1272187","tags":["report"]},{"url":"https://bugzilla.suse.com/1272194","tags":["report"]},{"url":"https://bugzilla.suse.com/1272197","tags":["report"]},{"url":"https://bugzilla.suse.com/1272204","tags":["report"]},{"url":"https://bugzilla.suse.com/1272207","tags":["report"]},{"url":"https://bugzilla.suse.com/1272211","tags":["report"]},{"url":"https://bugzilla.suse.com/1272242","tags":["report"]},{"url":"https://bugzilla.suse.com/1272246","tags":["report"]},{"url":"https://bugzilla.suse.com/1272263","tags":["report"]},{"url":"https://bugzilla.suse.com/1272268","tags":["report"]},{"url":"https://bugzilla.suse.com/1272282","tags":["report"]},{"url":"https://bugzilla.suse.com/1272296","tags":["report"]},{"url":"https://bugzilla.suse.com/1272359","tags":["report"]},{"url":"https://bugzilla.suse.com/1272360","tags":["report"]},{"url":"https://bugzilla.suse.com/1272361","tags":["report"]},{"url":"https://bugzilla.suse.com/1272362","tags":["report"]},{"url":"https://bugzilla.suse.com/1272373","tags":["report"]},{"url":"https://bugzilla.suse.com/1272374","tags":["report"]},{"url":"https://bugzilla.suse.com/1272380","tags":["report"]},{"url":"https://bugzilla.suse.com/1272381","tags":["report"]},{"url":"https://bugzilla.suse.com/1272383","tags":["report"]},{"url":"https://bugzilla.suse.com/1272384","tags":["report"]},{"url":"https://bugzilla.suse.com/1272387","tags":["report"]},{"url":"https://bugzilla.suse.com/1272389","tags":["report"]},{"url":"https://bugzilla.suse.com/1272406","tags":["report"]},{"url":"https://bugzilla.suse.com/1272422","tags":["report"]},{"url":"https://bugzilla.suse.com/1272434","tags":["report"]},{"url":"https://bugzilla.suse.com/1272462","tags":["report"]},{"url":"https://bugzilla.suse.com/1272466","tags":["report"]},{"url":"https://bugzilla.suse.com/1272467","tags":["report"]},{"url":"https://bugzilla.suse.com/1272468","tags":["report"]},{"url":"https://bugzilla.suse.com/1272470","tags":["report"]},{"url":"https://bugzilla.suse.com/1272471","tags":["report"]},{"url":"https://bugzilla.suse.com/1272472","tags":["report"]},{"url":"https://bugzilla.suse.com/1272474","tags":["report"]},{"url":"https://bugzilla.suse.com/1272478","tags":["report"]},{"url":"https://bugzilla.suse.com/1272480","tags":["report"]},{"url":"https://bugzilla.suse.com/1272482","tags":["report"]},{"url":"https://bugzilla.suse.com/1272483","tags":["report"]},{"url":"https://bugzilla.suse.com/1272489","tags":["report"]},{"url":"https://bugzilla.suse.com/1272492","tags":["report"]},{"url":"https://bugzilla.suse.com/1272494","tags":["report"]},{"url":"https://bugzilla.suse.com/1272499","tags":["report"]},{"url":"https://bugzilla.suse.com/1272500","tags":["report"]},{"url":"https://bugzilla.suse.com/1272504","tags":["report"]},{"url":"https://bugzilla.suse.com/1272505","tags":["report"]},{"url":"https://bugzilla.suse.com/1272514","tags":["report"]},{"url":"https://bugzilla.suse.com/1272517","tags":["report"]},{"url":"https://bugzilla.suse.com/1272522","tags":["report"]},{"url":"https://bugzilla.suse.com/1272523","tags":["report"]},{"url":"https://bugzilla.suse.com/1272524","tags":["report"]},{"url":"https://bugzilla.suse.com/1272568","tags":["report"]},{"url":"https://bugzilla.suse.com/1272572","tags":["report"]},{"url":"https://bugzilla.suse.com/1272573","tags":["report"]},{"url":"https://bugzilla.suse.com/1272578","tags":["report"]},{"url":"https://bugzilla.suse.com/1272591","tags":["report"]},{"url":"https://bugzilla.suse.com/1272607","tags":["report"]},{"url":"https://bugzilla.suse.com/1272610","tags":["report"]},{"url":"https://bugzilla.suse.com/1272612","tags":["report"]},{"url":"https://bugzilla.suse.com/1272613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272614","tags":["report"]},{"url":"https://bugzilla.suse.com/1272617","tags":["report"]},{"url":"https://bugzilla.suse.com/1272618","tags":["report"]},{"url":"https://bugzilla.suse.com/1272620","tags":["report"]},{"url":"https://bugzilla.suse.com/1272642","tags":["report"]},{"url":"https://bugzilla.suse.com/1272646","tags":["report"]},{"url":"https://bugzilla.suse.com/1272659","tags":["report"]},{"url":"https://bugzilla.suse.com/1272662","tags":["report"]},{"url":"https://bugzilla.suse.com/1272664","tags":["report"]},{"url":"https://bugzilla.suse.com/1272665","tags":["report"]},{"url":"https://bugzilla.suse.com/1272668","tags":["report"]},{"url":"https://bugzilla.suse.com/1272670","tags":["report"]},{"url":"https://bugzilla.suse.com/1272671","tags":["report"]},{"url":"https://bugzilla.suse.com/1272675","tags":["report"]},{"url":"https://bugzilla.suse.com/1272678","tags":["report"]},{"url":"https://bugzilla.suse.com/1272680","tags":["report"]},{"url":"https://bugzilla.suse.com/1272681","tags":["report"]},{"url":"https://bugzilla.suse.com/1272682","tags":["report"]},{"url":"https://bugzilla.suse.com/1272685","tags":["report"]},{"url":"https://bugzilla.suse.com/1272686","tags":["report"]},{"url":"https://bugzilla.suse.com/1272689","tags":["report"]},{"url":"https://bugzilla.suse.com/1272690","tags":["report"]},{"url":"https://bugzilla.suse.com/1272691","tags":["report"]},{"url":"https://bugzilla.suse.com/1272693","tags":["report"]},{"url":"https://bugzilla.suse.com/1272694","tags":["report"]},{"url":"https://bugzilla.suse.com/1272706","tags":["report"]},{"url":"https://bugzilla.suse.com/1272781","tags":["report"]},{"url":"https://bugzilla.suse.com/1272785","tags":["report"]},{"url":"https://bugzilla.suse.com/1272787","tags":["report"]},{"url":"https://bugzilla.suse.com/1272797","tags":["report"]},{"url":"https://bugzilla.suse.com/1272800","tags":["report"]},{"url":"https://bugzilla.suse.com/1272807","tags":["report"]},{"url":"https://bugzilla.suse.com/1272836","tags":["report"]},{"url":"https://bugzilla.suse.com/1272843","tags":["report"]},{"url":"https://bugzilla.suse.com/1272847","tags":["report"]},{"url":"https://bugzilla.suse.com/1272848","tags":["report"]},{"url":"https://bugzilla.suse.com/1272850","tags":["report"]},{"url":"https://bugzilla.suse.com/1272853","tags":["report"]},{"url":"https://bugzilla.suse.com/1272858","tags":["report"]},{"url":"https://bugzilla.suse.com/1272863","tags":["report"]},{"url":"https://bugzilla.suse.com/1272867","tags":["report"]},{"url":"https://bugzilla.suse.com/1272871","tags":["report"]},{"url":"https://bugzilla.suse.com/1272891","tags":["report"]},{"url":"https://bugzilla.suse.com/1272892","tags":["report"]},{"url":"https://bugzilla.suse.com/1272897","tags":["report"]},{"url":"https://bugzilla.suse.com/1272903","tags":["report"]},{"url":"https://bugzilla.suse.com/1272907","tags":["report"]},{"url":"https://bugzilla.suse.com/1272920","tags":["report"]},{"url":"https://bugzilla.suse.com/1272973","tags":["report"]},{"url":"https://bugzilla.suse.com/1272993","tags":["report"]},{"url":"https://bugzilla.suse.com/1273005","tags":["report"]},{"url":"https://bugzilla.suse.com/1273023","tags":["report"]},{"url":"https://bugzilla.suse.com/1273035","tags":["report"]},{"url":"https://bugzilla.suse.com/1273044","tags":["report"]},{"url":"https://bugzilla.suse.com/1273053","tags":["report"]},{"url":"https://bugzilla.suse.com/1273054","tags":["report"]},{"url":"https://bugzilla.suse.com/1273117","tags":["report"]},{"url":"https://bugzilla.suse.com/1273231","tags":["report"]},{"url":"https://bugzilla.suse.com/1274072","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623221-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623231-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623237-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-38238","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-38238","tags":["report"]},{"url":"https://git.kernel.org/linus/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7833-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7834-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7833-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7833-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7833-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7856-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-36350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38323","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-38238","title":"scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them","status":"published","published":"2025-07-09T10:42:23.538Z","modified":"2026-10-15T21:52:12.048Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:32:47.447481Z"}],"euvd":[{"id":"EUVD-2025-20822","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them","status":"published","published":"2025-07-09T10:42:23Z","modified":"2026-10-15T21:52:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:08.406985Z"}],"ghsa":[{"id":"GHSA-xh6p-h9xv-5c64","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them","status":"published","published":"2025-07-09T12:31:34Z","modified":"2025-11-19T18:32:17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:04:53.049342Z"}],"nvd":[{"id":"CVE-2025-38238","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them","status":"published","published":"2025-07-09T11:15:25.08Z","modified":"2026-10-15T22:18:36.02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:11:17.727956Z"}],"osv":[{"id":"BELL-CVE-2025-38238","status":"published","published":"2025-07-10T06:00:17.575789Z","modified":"2026-06-25T07:18:27.664062883Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.997209Z"},{"id":"CVE-2025-38238","title":"scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them","status":"published","published":"2025-07-09T10:42:23.538Z","modified":"2026-10-28T02:30:31.813800658Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:48.703031Z"},{"id":"UBUNTU-CVE-2025-38238","description":"In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to send ABTS for each of them. On send completion, this causes an attempt to free the same frame twice that leads to a crash. Fix crash by allocating separate frames for RHBA and RPA, and modify ABTS logic accordingly. Tested by checking MDS for FDMI information. Tested by using instrumented driver to:  - Drop PLOGI response  - Drop RHBA response  - Drop RPA response  - Drop RHBA and RPA response  - Drop PLOGI response + ABTS response  - Drop RHBA response + ABTS response  - Drop RPA response + ABTS response  - Drop RHBA and RPA response + ABTS response for both of them","status":"published","published":"2025-07-09T11:15:00Z","modified":"2026-09-09T14:35:21.00731631Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:33.787705Z"},{"id":"openSUSE-SU-2026:21555-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-12T01:09:28Z","modified":"2026-08-12T17:45:23.234348653Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2025:02853-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n- CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).\n- CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).\n- CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).\n- CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).\n- CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).\n- CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).\n- CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).\n- CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).\n- CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).\n- CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).\n- CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).\n- CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).\n- CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).\n- CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).\n- CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).\n- CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).\n- CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).\n- CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).\n- CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).\n- CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).\n- CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).\n- CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).\n- CVE-2025-38074: vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex (bsc#1244735).\n- CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).\n- CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).\n- CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).\n- CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).\n- CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).\n- CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).\n- CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).\n- CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).\n- CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).\n- CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).\n- CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).\n- CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).\n- CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).\n- CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).\n- CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).\n- CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).\n- CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).\n- CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).\n- CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).\n- CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).\n- CVE-2025-38188: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (bsc#1246098).\n- CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).\n- CVE-2025-38202: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (bsc#1245980).\n- CVE-2025-38203: jfs: Fix null-ptr-deref in jfs_ioc_trim (bsc#1246044).\n- CVE-2025-38204: jfs: fix array-index-out-of-bounds read in add_missing_indices (bsc#1245983).\n- CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).\n- CVE-2025-38210: configfs-tsm-report: Fix NULL dereference of tsm_ops (bsc#1246020).\n- CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).\n- CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).\n- CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).\n- CVE-2025-38236: af_unix: Disable MSG_OOB for unprivileged users (bsc#1246093).\n- CVE-2025-38239: scsi: megaraid_sas: Fix invalid node index (bsc#1246178).\n- CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).\n- CVE-2025-38248: bridge: mcast: Fix use-after-free during router port configuration (bsc#1246173).\n- CVE-2025-38250: kABI workaround for bluetooth hci_dev changes (bsc#1246182).\n- CVE-2025-38256: io_uring/rsrc: fix folio unpinning (bsc#1246188).\n- CVE-2025-38264: llist: add interface to check if a node is on a list (bsc#1246387).\n- CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).\n- CVE-2025-38279: selftests/bpf: Add tests with stack ptr register in conditional jmp (bsc#1246264).\n- CVE-2025-38283: hisi_acc_vfio_pci: bugfix live migration function without VF device driver (bsc#1246273).\n- CVE-2025-38303: Bluetooth: eir: Fix possible crashes on eir_create_adv_data (bsc#1246354).\n- CVE-2025-38310: seg6: Fix validation of nexthop addresses (bsc#1246361).\n- CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).\n- CVE-2025-38334: x86/sgx: Prevent attempts to reclaim poisoned pages (bsc#1246384).\n- CVE-2025-38335: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (bsc#1246250).\n- CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).\n- CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).\n- CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).\n- CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).\n- CVE-2025-38364: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (bsc#1247091).\n- CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).\n- CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).\n- CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).\n- CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).\n- CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).\n- CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).\n- CVE-2025-38403: vsock/vmci: Clear the vmci transport packet properly when initializing it (bsc#1247141).\n- CVE-2025-38414: wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (bsc#1247145).\n- CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).\n- CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written (bsc#1247253).\n- CVE-2025-38453: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234).\n- CVE-2025-38455: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (bsc#1247101).\n- CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).\n- CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).\n- CVE-2025-38461: vsock: Fix transport_* TOCTOU (bsc#1247103).\n- CVE-2025-38462: vsock: Fix transport_{g2h,h2g} TOCTOU (bsc#1247104).\n- CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).\n- CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).\n- CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).\n- CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).\n- CVE-2025-38475: smc: Fix various oops due to inet_sock type confusion (bsc#1247308).\n- CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).\n- CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).\n\nThe following non-security bugs were fixed:\n\n- Enable SMC_LO (a.k.a SMC-D) (jsc#PED-13248).\n- Fix dma_unmap_sg() nents value (git-fixes)\n- Logitech C-270 even more broken (stable-fixes).\n- Re-enable qmi_wwan for arm64 (bsc#1246113)\n- Reapply 'wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()' (git-fixes).\n- Revert 'ACPI: battery: negate current when discharging' (stable-fixes).\n- Revert 'cgroup_freezer: cgroup_freezing: Check if not frozen' (bsc#1219338).\n- Revert 'drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1' (stable-fixes).\n- Revert 'drm/nouveau: check ioctl command codes better' (git-fixes).\n- Revert 'drm/xe/xe2: Enable Indirect Ring State support for Xe2' (git-fixes).\n- Revert 'mmc: sdhci: Disable SD card clock before changing parameters' (git-fixes).\n- Revert 'usb: xhci: Implement xhci_handshake_check_state() helper' (git-fixes).\n- Revert 'vgacon: Add check for vc_origin address range in vgacon_scroll()' (stable-fixes).\n- Update config files. config/x86_64/default config/arm64/default CONFIG_INTEGRITY_MACHINE_KEYRING=y +CONFIG_INTEGRITY_CA_MACHINE_KEYRING=y +CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y +CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y (bsc#1243678)\n- accel/ivpu: Remove copy engine support (stable-fixes).\n- acpi: LPSS: Remove AudioDSP related ID (git-fixes).\n- acpi: PRM: Reduce unnecessary printing to avoid user confusion (bsc#1246122).\n- acpi: processor: perflib: Fix initial _PPC limit application (git-fixes).\n- acpica: Refuse to evaluate a method if arguments are missing (stable-fixes).\n- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (git-fixes).\n- af_unix: Add a prompt to CONFIG_AF_UNIX_OOB (bsc#1246093).\n- alsa: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (git-fixes).\n- alsa: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (stable-fixes).\n- alsa: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (stable-fixes).\n- alsa: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (stable-fixes).\n- alsa: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (git-fixes).\n- alsa: hda/tegra: Add Tegra264 support (stable-fixes).\n- alsa: hda: Add missing NVIDIA HDA codec IDs (stable-fixes).\n- alsa: hda: Add new pci id for AMD GPU display HD audio controller (stable-fixes).\n- alsa: hda: Ignore unsol events for cards being shut down (stable-fixes).\n- alsa: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (git-fixes).\n- alsa: sb: Do not allow changing the DMA mode during operations (stable-fixes).\n- alsa: sb: Force to disable DMAs once when DMA mode is changed (stable-fixes).\n- alsa: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (git-fixes).\n- amd/amdkfd: fix a kfd_process ref leak (stable-fixes).\n- aoe: clean device rq_list in aoedev_downdev() (git-fixes).\n- apple-mfi-fastcharge: protect first device name (git-fixes).\n- asoc: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (stable-fixes).\n- asoc: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (stable-fixes).\n- asoc: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (stable-fixes).\n- asoc: amd: yc: update quirk data for HP Victus (stable-fixes).\n- asoc: codec: wcd9335: Convert to GPIO descriptors (stable-fixes).\n- asoc: codecs: wcd9335: Fix missing free of regulator supplies (git-fixes).\n- asoc: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe() (stable-fixes).\n- asoc: cs35l56: probe() should fail if the device ID is not recognized (git-fixes).\n- asoc: fsl_asrc: use internal measured ratio for non-ideal ratio mode (git-fixes).\n- asoc: fsl_sai: Force a software reset when starting in consumer mode (git-fixes).\n- asoc: fsl_xcvr: get channel status data when PHY is not exists (git-fixes).\n- asoc: mediatek: use reserved memory or enable buffer pre-allocation (git-fixes).\n- asoc: ops: dynamically allocate struct snd_ctl_elem_value (git-fixes).\n- asoc: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (git-fixes).\n- ata: pata_cs5536: fix build on 32-bit UML (stable-fixes).\n- audit,module: restore audit logging in load failure case (git-fixes).\n- bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (git-fixes).\n- bluetooth: HCI: Set extended advertising data synchronously (git-fixes).\n- bluetooth: L2CAP: Fix L2CAP MTU negotiation (stable-fixes).\n- bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (git-fixes).\n- bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT (git-fixes).\n- bluetooth: MGMT: mesh_send: check instances prior disabling advertising (git-fixes).\n- bluetooth: MGMT: set_mesh: update LE scan interval and window (git-fixes).\n- bluetooth: Prevent unintended pause by checking if advertising is active (git-fixes).\n- bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (git-fixes).\n- bluetooth: SMP: If an unallowed command is received consider it a failure (git-fixes).\n- bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (git-fixes).\n- bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (git-fixes).\n- bluetooth: hci_conn: Fix sending BT_HCI_CMD_LE_CREATE_CONN_CANCEL (git-fixes).\n- bluetooth: hci_core: add missing braces when using macro parameters (git-fixes).\n- bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (git-fixes).\n- bluetooth: hci_event: Mask data status from LE ext adv reports (git-fixes).\n- bluetooth: hci_sync: Attempt to dequeue connection attempt (git-fixes).\n- bluetooth: hci_sync: Fix UAF on create_le_conn_complete (git-fixes).\n- bluetooth: hci_sync: Fix handling of HCI_OP_CREATE_CONN_CANCEL (git-fixes).\n- bluetooth: hci_sync: Fix not disabling advertising instance (git-fixes).\n- bluetooth: hci_sync: fix connectable extended advertising when using static random address (git-fixes).\n- bluetooth: hci_sync: revert some mesh modifications (git-fixes).\n- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (git-fixes).\n- bonding: Correctly support GSO ESP offload (git-fixes).\n- bpf, sockmap: Fix sk_msg_reset_curr (git-fixes).\n- bpf/lpm_trie: Inline longest_prefix_match for fastpath (git-fixes).\n- bpf/selftests: Check errno when percpu map value size exceeds (git-fixes).\n- bpf: Add a possibly-zero-sized read test (git-fixes).\n- bpf: Avoid __hidden__ attribute in static object (git-fixes).\n- bpf: Check percpu map value size first (git-fixes).\n- bpf: Disable some `attribute ignored' warnings in GCC (git-fixes).\n- bpf: Fix memory leak in bpf_core_apply (git-fixes).\n- bpf: Fix potential integer overflow in resolve_btfids (git-fixes).\n- bpf: Harden __bpf_kfunc tag against linker kfunc removal (git-fixes).\n- bpf: Make the pointer returned by iter next method valid (git-fixes).\n- bpf: Simplify checking size of helper accesses (git-fixes).\n- bpf: fix order of args in call to bpf_map_kvcalloc (git-fixes).\n- bpf: sockmap, updating the sg structure should also update curr (git-fixes).\n- bpftool: Fix missing pids during link show (git-fixes).\n- bpftool: Fix undefined behavior caused by shifting into the sign bit (git-fixes).\n- bpftool: Mount bpffs on provided dir instead of parent dir (git-fixes).\n- bpftool: Remove unnecessary source files from bootstrap version (git-fixes).\n- bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer (git-fixes).\n- btrfs: do not ignore inode missing when replaying log tree (git-fixes).\n- btrfs: do not silently ignore unexpected extent type when replaying log (git-fixes).\n- btrfs: do not skip remaining extrefs if dir not found during log replay (git-fixes).\n- btrfs: explicitly ref count block_group on new_bgs list (bsc#1243068)\n- btrfs: fix assertion when building free space tree (git-fixes).\n- btrfs: fix inode lookup error handling during log replay (git-fixes).\n- btrfs: fix invalid inode pointer dereferences during log replay (git-fixes).\n- btrfs: fix log tree replay failure due to file with 0 links and extents (git-fixes).\n- btrfs: fix missing error handling when searching for inode refs during log replay (git-fixes).\n- btrfs: fix non-empty delayed iputs list on unmount due to async workers (git-fixes).\n- btrfs: fix ssd_spread overallocation (git-fixes).\n- btrfs: make btrfs_discard_workfn() block_group ref explicit (bsc#1243068)\n- btrfs: propagate last_unlink_trans earlier when doing a rmdir (git-fixes).\n- btrfs: rename err to ret in btrfs_rmdir() (git-fixes).\n- btrfs: return a btrfs_inode from btrfs_iget_logging() (git-fixes).\n- btrfs: return a btrfs_inode from read_one_inode() (git-fixes).\n- btrfs: tests: fix chunk map leak after failure to add it to the tree (git-fixes).\n- btrfs: update superblock's device bytes_used when dropping chunk (git-fixes).\n- btrfs: use NOFS context when getting inodes during logging and log replay (git-fixes).\n- btrfs: use btrfs_record_snapshot_destroy() during rmdir (git-fixes).\n- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (git-fixes).\n- bus: mhi: host: Detect events pointing to unexpected TREs (git-fixes).\n- can: dev: can_restart(): move debug message and stats after successful restart (stable-fixes).\n- can: dev: can_restart(): reverse logic to remove need for goto (stable-fixes).\n- can: kvaser_pciefd: Store device channel index (git-fixes).\n- can: kvaser_usb: Assign netdev.dev_port based on device channel index (git-fixes).\n- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (git-fixes).\n- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (git-fixes).\n- can: peak_usb: fix USB FD devices potential malfunction (git-fixes).\n- cdc-acm: fix race between initial clearing halt and open (git-fixes).\n- cgroup,freezer: fix incomplete freezing when attaching tasks (bsc#1245789).\n- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (bsc#1241166).\n- cifs: reconnect helper should set reconnect for the right channel (git-fixes).\n- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (git-fixes).\n- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (git-fixes).\n- clk: sunxi-ng: v3s: Fix de clock definition (git-fixes).\n- clk: xilinx: vcu: unregister pll_post only if registered correctly (git-fixes).\n- clocksource: Scale the watchdog read retries automatically (bsc#1241345 bsc#1244457).\n- clocksource: Set cs_watchdog_read() checks based on .uncertainty_margin (bsc#1241345 bsc#1244457).\n- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (git-fixes).\n- comedi: Fix initialization of data for instructions that write to subdevice (git-fixes).\n- comedi: Fix some signed shift left operations (git-fixes).\n- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (git-fixes).\n- comedi: aio_iiro_16: Fix bit shift out of bounds (git-fixes).\n- comedi: das16m1: Fix bit shift out of bounds (git-fixes).\n- comedi: das6402: Fix bit shift out of bounds (git-fixes).\n- comedi: pcl812: Fix bit shift out of bounds (git-fixes).\n- compiler_types.h: Define __retain for __attribute__((__retain__)) (git-fixes).\n- crypto: arm/aes-neonbs - work around gcc-15 warning (git-fixes).\n- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (git-fixes).\n- crypto: ccp - Fix locking on alloc failure handling (git-fixes).\n- crypto: hkdf - skip TVs with unapproved salt lengths in FIPS mode (bsc#1241200 bsc#1246134).\n- crypto: img-hash - Fix dma_unmap_sg() nents value (git-fixes).\n- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (git-fixes).\n- crypto: keembay - Fix dma_unmap_sg() nents value (git-fixes).\n- crypto: marvell/cesa - Fix engine load inaccuracy (git-fixes).\n- crypto: qat - allow enabling VFs in the absence of IOMMU (git-fixes).\n- crypto: qat - disable ZUC-256 capability for QAT GEN5 (git-fixes).\n- crypto: qat - fix DMA direction for compression on GEN2 devices (git-fixes).\n- crypto: qat - fix seq_file position update in adf_ring_next() (git-fixes).\n- crypto: qat - fix state restore for banks with exceptions (git-fixes).\n- crypto: qat - flush misc workqueue during device shutdown (git-fixes).\n- crypto: qat - use unmanaged allocation for dc_data (git-fixes).\n- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (git-fixes).\n- dax: add a sysfs knob to control memmap_on_memory behavior (bsc#1235515,jsc#PED-12731).\n- devlink: Add support for u64 parameters (jsc#PED-12745).\n- devlink: avoid param type value translations (jsc#PED-12745).\n- devlink: define enum for attr types of dynamic attributes  (jsc#PED-12745).\n- devlink: define enum for attr types of dynamic attributes (jsc#PED-12745).\n- devlink: introduce devlink_nl_put_u64() (jsc#PED-12745).\n- dm-bufio: fix sched in atomic context (git-fixes).\n- dm-flakey: error all IOs when num_features is absent (git-fixes).\n- dm-flakey: make corrupting read bios work (git-fixes).\n- dm-mirror: fix a tiny race condition (git-fixes).\n- dm-raid: fix variable in journal device check (git-fixes).\n- dm-verity: fix a memory leak if some arguments are specified multiple times (git-fixes).\n- dm: do not change md if dm_table_set_restrictions() fails (git-fixes).\n- dm: free table mempools if not used in __bind (git-fixes).\n- dm: restrict dm device size to 2^63-512 bytes (git-fixes).\n- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (stable-fixes).\n- dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() (git-fixes).\n- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (stable-fixes).\n- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (git-fixes).\n- dmaengine: nbpfaxi: Add missing check after DMA map (git-fixes).\n- dmaengine: nbpfaxi: Fix memory corruption in probe() (git-fixes).\n- dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() (git-fixes).\n- dmaengine: xilinx_dma: Set dma_device directions (stable-fixes).\n- docs/ABI: Fix sysfs-kernel-address_bits path (git-fixes).\n- documentatiion/ABI: add ABI documentation for sys-bus-dax (bsc#1235515,jsc#PED-12731).\n- documentation: ACPI: Fix parent device references (git-fixes).\n- documentation: usb: gadget: Wrap remaining usage snippets in literal code block (git-fixes).\n- dpll: Add basic Microchip ZL3073x support (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set frequency on pins  (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set frequency on pins (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set priority on input pins  (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set priority on input pins (jsc#PED-12745).\n- dpll: zl3073x: Fetch invariants during probe (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin selection in manual mode  (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin selection in manual mode (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin state setting in automatic  mode (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin state setting in automatic mode (jsc#PED-12745).\n- dpll: zl3073x: Read DPLL types and pin properties from system  firmware (jsc#PED-12745).\n- dpll: zl3073x: Read DPLL types and pin properties from system firmware (jsc#PED-12745).\n- dpll: zl3073x: Register DPLL devices and pins (jsc#PED-12745).\n- drm/amd/display: Check dce_hwseq before dereferencing it (stable-fixes).\n- drm/amd/display: Correct non-OLED pre_T11_delay (stable-fixes).\n- drm/amd/display: Disable CRTC degamma LUT for DCN401 (stable-fixes).\n- drm/amd/display: Do not overwrite dce60_clk_mgr (git-fixes).\n- drm/amd/display: Fix RMCM programming seq errors (stable-fixes).\n- drm/amd/display: Fix mpv playback corruption on weston (stable-fixes).\n- drm/amd/display: Free memory allocation (stable-fixes).\n- drm/amd/display: fix initial backlight brightness calculation (git-fixes).\n- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (git-fixes).\n- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (stable-fixes).\n- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (git-fixes).\n- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/ip_discovery: add missing ip_discovery fw (stable-fixes).\n- drm/amdgpu: Add kicker device detection (stable-fixes).\n- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (stable-fixes).\n- drm/amdgpu: Increase reset counter only on success (stable-fixes).\n- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (git-fixes).\n- drm/amdgpu: Remove nbiov7.9 replay count reporting (git-fixes).\n- drm/amdgpu: Reset the clear flag in buddy during resume (git-fixes).\n- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (stable-fixes).\n- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (stable-fixes).\n- drm/amdkfd: Do not call mmput from MMU notifier callback (git-fixes).\n- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (stable-fixes).\n- drm/amdkfd: Fix race in GWS queue scheduling (stable-fixes).\n- drm/amdkfd: remove gfx 12 trap handler page size cap (stable-fixes).\n- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (git-fixes).\n- drm/bridge: panel: move prepare_prev_first handling to drm_panel_bridge_add_typed (git-fixes).\n- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (git-fixes).\n- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (git-fixes).\n- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (stable-fixes).\n- drm/connector: hdmi: Evaluate limited range after computing format (git-fixes).\n- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (git-fixes).\n- drm/exynos: fimd: Guard display clock control with runtime PM calls (git-fixes).\n- drm/framebuffer: Acquire internal references on GEM handles (git-fixes).\n- drm/gem: Acquire references on GEM handles for framebuffers (stable-fixes).\n- drm/gem: Fix race in drm_gem_handle_create_tail() (stable-fixes).\n- drm/i915/display: Fix dma_fence_wait_timeout() return value handling (git-fixes).\n- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (stable-fixes).\n- drm/i915/gsc: mei interrupt top half should be in irq disabled context (git-fixes).\n- drm/i915/gt: Fix timeline left held on VMA alloc error (git-fixes).\n- drm/i915/selftests: Change mock_request() to return error pointers (git-fixes).\n- drm/imagination: Fix kernel crash when hard resetting the GPU (git-fixes).\n- drm/mediatek: Add wait_event_timeout when disabling plane (git-fixes).\n- drm/mediatek: only announce AFBC if really supported (git-fixes).\n- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (git-fixes).\n- drm/msm: Fix a fence leak in submit error path (stable-fixes).\n- drm/msm: Fix another leak in the submit error path (stable-fixes).\n- drm/nouveau: check ioctl command codes better (git-fixes).\n- drm/panfrost: Fix panfrost device variable name in devfreq (git-fixes).\n- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (git-fixes).\n- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (git-fixes).\n- drm/sched: Increment job count before swapping tail spsc queue (git-fixes).\n- drm/sched: Remove optimization that causes hang when killing dependent jobs (git-fixes).\n- drm/scheduler: signal scheduled fence when kill job (stable-fixes).\n- drm/tegra: nvdec: Fix dma_alloc_coherent error check (git-fixes).\n- drm/ttm: fix error handling in ttm_buffer_object_transfer (git-fixes).\n- drm/v3d: Disable interrupts before resetting the GPU (git-fixes).\n- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (git-fixes).\n- drm/xe/bmg: fix compressed VRAM handling (git-fixes).\n- drm/xe/guc: Dead CT helper (stable-fixes).\n- drm/xe/guc: Explicitly exit CT safe mode on unwind (git-fixes).\n- drm/xe/guc_submit: add back fix (git-fixes).\n- drm/xe/mocs: Initialize MOCS index early (stable-fixes).\n- drm/xe/pf: Clear all LMTT pages on alloc (git-fixes).\n- drm/xe/pf: Move VFs reprovisioning to worker (stable-fixes).\n- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (git-fixes).\n- drm/xe/pf: Sanitize VF scratch registers on FLR (stable-fixes).\n- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (git-fixes).\n- drm/xe/uapi: Correct sync type definition in comments (git-fixes).\n- drm/xe/vf: Disable CSC support on VF (git-fixes).\n- drm/xe: Allocate PF queue size on pow2 boundary (git-fixes).\n- drm/xe: Allow bo mapping on multiple ggtts (stable-fixes).\n- drm/xe: Fix DSB buffer coherency (stable-fixes).\n- drm/xe: Fix build without debugfs (git-fixes).\n- drm/xe: Fix early wedge on GuC load failure (git-fixes).\n- drm/xe: Fix taking invalid lock on wedge (stable-fixes).\n- drm/xe: Move DSB l2 flush to a more sensible place (git-fixes).\n- drm/xe: Replace double space with single space after comma (stable-fixes).\n- drm/xe: add interface to request physical alignment for buffer objects (stable-fixes).\n- drm/xe: move DPT l2 flush to a more sensible place (git-fixes).\n- dt-bindings: dpll: Add DPLL device and pin (jsc#PED-12745).\n- dt-bindings: dpll: Add support for Microchip Azurite chip family  (jsc#PED-12745).\n- dt-bindings: dpll: Add support for Microchip Azurite chip family (jsc#PED-12745).\n- e1000: Move cancel_work_sync to avoid deadlock (git-fixes).\n- exfat: fdatasync flag should be same like generic_write_sync() (git-fixes).\n- fbcon: Fix outdated registered_fb reference in comment (git-fixes).\n- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (git-fixes).\n- firewire: ohci: correct code comments about bus_reset tasklet (git-fixes).\n- fs/jfs: consolidate sanity checking in dbMount (git-fixes).\n- fs/orangefs: Allow 2 more characters in do_c_string() (git-fixes).\n- gpio: mlxbf2: use platform_get_irq_optional() (git-fixes).\n- gpio: pca953x: log an error when failing to get the reset GPIO (git-fixes).\n- gpio: sim: include a missing header (git-fixes).\n- gpio: vf610: add locking to gpio direction functions (git-fixes).\n- gpio: virtio: Fix config space reading (git-fixes).\n- gpiolib: Fix debug messaging in gpiod_find_and_request() (git-fixes).\n- gpiolib: Handle no pin_ranges in gpiochip_generic_config() (git-fixes).\n- gpiolib: acpi: Do not use GPIO chip fwnode in acpi_gpiochip_find() (bsc#1233300).\n- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match (bsc#1233300).\n- gpiolib: cdev: Ignore reconfiguration without direction (git-fixes).\n- gpiolib: of: Add polarity quirk for s5m8767 (stable-fixes).\n- hfs: make splice write available again (git-fixes).\n- hfsplus: make splice write available again (git-fixes).\n- hfsplus: remove mutex_lock check in hfsplus_free_extents (git-fixes).\n- hid: Add IGNORE quirk for SMARTLINKTECHNOLOGY (stable-fixes).\n- hid: core: do not bypass hid_hw_raw_request (stable-fixes).\n- hid: core: ensure __hid_request reserves the report ID as the first byte (git-fixes).\n- hid: core: ensure the allocated report buffer can contain the reserved report ID (stable-fixes).\n- hid: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (stable-fixes).\n- hid: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (stable-fixes).\n- hv_netvsc: Use VF's tso_max_size value when data path is VF (bsc#1246203).\n- hwmon: (corsair-cpro) Validate the size of the received input buffer (git-fixes).\n- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (git-fixes).\n- hwmon: (pmbus/max34440) Fix support for max34451 (stable-fixes).\n- hwrng: mtk - handle devm_pm_runtime_enable errors (git-fixes).\n- i2c/designware: Fix an initialization issue (git-fixes).\n- i2c: qup: jump out of the loop in case of timeout (git-fixes).\n- i2c: stm32: fix the device used for the DMA map (git-fixes).\n- i2c: tegra: Fix reset error handling with ACPI (git-fixes).\n- i2c: virtio: Avoid hang by using interruptible completion wait (git-fixes).\n- i3c: fix module_i3c_i2c_driver() with I3C=n (git-fixes).\n- ib/mlx5: Fix potential deadlock in MR deregistration (git-fixes)\n- ice, irdma: fix an off by one in error handling code (bsc#1247712).\n- ice, irdma: move interrupts code to irdma (bsc#1247712).\n- ice: Fix signedness bug in ice_init_interrupt_scheme() (bsc#1247712).\n- ice: count combined queues using Rx/Tx count (bsc#1247712).\n- ice: devlink PF MSI-X max and min parameter (bsc#1247712).\n- ice: enable_rdma devlink param (bsc#1247712).\n- ice: fix eswitch code memory leak in reset scenario (git-fixes).\n- ice: get rid of num_lan_msix field (bsc#1247712).\n- ice: init flow director before RDMA (bsc#1247712).\n- ice: remove splitting MSI-X between features (bsc#1247712).\n- ice: simplify VF MSI-X managing (bsc#1247712).\n- ice: treat dyn_allowed only as suggestion (bsc#1247712).\n- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (git-fixes).\n- iio: adc: ad7949: use spi_is_bpw_supported() (git-fixes).\n- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (stable-fixes).\n- iio: adc: ad_sigma_delta: change to buffer predisable (git-fixes).\n- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (stable-fixes).\n- iio: adc: max1363: Reorder mode_list[] entries (stable-fixes).\n- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (git-fixes).\n- iio: imu: bno055: fix OOB access of hw_xlate array (git-fixes).\n- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (stable-fixes).\n- input: iqs7222 - explicitly define number of external channels (git-fixes).\n- input: xpad - adjust error handling for disconnect (git-fixes).\n- input: xpad - set correct controller type for Acer NGR200 (git-fixes).\n- input: xpad - support Acer NGR 200 Controller (stable-fixes).\n- io_uring/timeout: fix multishot updates (bsc#1247021).\n- io_uring: fix potential page leak in io_sqe_buffer_register() (git-fixes).\n- iommu/amd: Fix geometry.aperture_end for V2 tables (git-fixes).\n- iommu/amd: Set the pgsize_bitmap correctly (git-fixes).\n- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (git-fixes).\n- iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding (git-fixes).\n- iommu/vt-d: Fix possible circular locking dependency (git-fixes).\n- iommu/vt-d: Fix system hang on reboot -f (git-fixes).\n- ipv6: fix possible infinite loop in fib6_info_uses_dev() (git-fixes).\n- ipv6: mcast: Delay put pmc-\u003eidev in mld_del_delrec() (git-fixes).\n- ipv6: prevent infinite loop in rt6_nlmsg_size() (git-fixes).\n- ipv6: reject malicious packets in ipv6_gso_segment() (git-fixes).\n- irdma: free iwdev-\u003erf after removing MSI-X (bsc#1247712).\n- iwlwifi: Add missing check for alloc_ordered_workqueue (git-fixes).\n- jfs: fix metapage reference count leak in dbAllocCtl (git-fixes).\n- kABI fix after KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).\n- kABI fixes for struct memory_block changes  (bsc#1235515,jsc#PED-12731).\n- kABI fixes for struct memory_block changes (bsc#1235515,jsc#PED-12731).\n- kABI workaround for fw_attributes_class_get() (stable-fixes).\n- kABI workaround for struct drm_framebuffer changes (git-fixes).\n- kABI: Fix the module::name type in audit_context (git-fixes).\n- kabi/severities: ignore two unused/dropped symbols from MEI\n- kabi: Hide adding of u64 to devlink_param_type (jsc#PED-12745).\n- kasan: remove kasan_find_vm_area() to prevent possible deadlock (git-fixes).\n- kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).\n- kvm: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).\n- leds: multicolor: Fix intensity setting while SW blinking (stable-fixes).\n- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (bsc#1236897).\n- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (bsc#1236897).\n- maple_tree: fix mt_destroy_walk() on root leaf node (git-fixes).\n- md/md-bitmap: fix dm-raid max_write_behind setting (git-fixes).\n- media: gspca: Add bounds checking to firmware parser (git-fixes).\n- media: hi556: correct the test pattern configuration (git-fixes).\n- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (git-fixes).\n- media: ipu6: isys: Use correct pads for xlate_streams() (git-fixes).\n- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (git-fixes).\n- media: ov2659: Fix memory leaks in ov2659_probe() (git-fixes).\n- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (git-fixes).\n- media: usbtv: Lock resolution while streaming (git-fixes).\n- media: uvcvideo: Do not mark valid metadata as invalid (git-fixes).\n- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (git-fixes).\n- media: v4l2-ctrls: Do not reset handler's error in v4l2_ctrl_handler_free() (git-fixes).\n- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (git-fixes).\n- media: venus: Add a check for packet size after reading from shared memory (git-fixes).\n- media: venus: hfi: explicitly release IRQ during teardown (git-fixes).\n- media: venus: protect against spurious interrupts during probe (git-fixes).\n- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240 (git-fixes).\n- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (git-fixes).\n- media: verisilicon: Fix AV1 decoder clock frequency (git-fixes).\n- media: vivid: fix wrong pixel_array control size (git-fixes).\n- mei: vsc: Destroy mutex after freeing the IRQ (git-fixes).\n- mei: vsc: Do not re-init VSC from mei_vsc_hw_reset() on stop (git-fixes).\n- mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq() (stable-fixes).\n- mei: vsc: Event notifier fixes (git-fixes).\n- mei: vsc: Fix 'BUG: Invalid wait context' lockdep error (git-fixes).\n- mei: vsc: Run event callback from a workqueue (git-fixes).\n- mei: vsc: Unset the event callback on remove and probe errors (git-fixes).\n- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (git-fixes).\n- mfd: max14577: Fix wakeup source leaks on device unbind (stable-fixes).\n- misc: rtsx: usb: Ensure mmc child device is active when card is present (git-fixes).\n- mm/memory_hotplug: allow architecture to override memmap on  memory support check (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow architecture to override memmap on memory support check (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow memmap on memory hotplug request to  fallback (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow memmap on memory hotplug request to fallback (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: embed vmem_altmap details in memory block  (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: embed vmem_altmap details in memory block (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: export mhp_supports_memmap_on_memory() (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval (git-fixes).\n- mm/memory_hotplug: replace an open-coded kmemdup() in (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: simplify ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE  kconfig (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: simplify ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE kconfig (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: split memmap_on_memory requests across memblocks (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: support memmap_on_memory when memmap is  not aligned to pageblocks (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: support memmap_on_memory when memmap is not aligned to pageblocks (bsc#1235515,jsc#PED-12731).\n- mmc: bcm2835: Fix dma_unmap_sg() nents value (git-fixes).\n- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (git-fixes).\n- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (git-fixes).\n- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (stable-fixes).\n- mmc: sdhci_am654: Workaround for Errata i2312 (git-fixes).\n- module: Fix memory deallocation on error path in move_module() (git-fixes).\n- module: Remove unnecessary +1 from last_unloaded_module::name size (git-fixes).\n- module: Restore the moduleparam prefix length check (git-fixes).\n- mtd: fix possible integer overflow in erase_xfer() (git-fixes).\n- mtd: rawnand: atmel: Fix dma_mapping_error() address (git-fixes).\n- mtd: rawnand: atmel: set pmecc data setup time (git-fixes).\n- mtd: rawnand: fsmc: Add missing check after DMA map (git-fixes).\n- mtd: rawnand: renesas: Add missing check after DMA map (git-fixes).\n- mtd: rawnand: rockchip: Add missing check after DMA map (git-fixes).\n- mtd: spi-nor: Fix spi_nor_try_unlock_all() (git-fixes).\n- mtd: spinand: fix memory leak of ECC engine conf (stable-fixes).\n- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (git-fixes).\n- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (git-fixes).\n- mtk-sd: Prevent memory corruption from DMA map failure (git-fixes).\n- mtk-sd: reset host-\u003emrq on prepare_data() error (git-fixes).\n- mwl8k: Add missing check after DMA map (git-fixes).\n- nbd: fix uaf in nbd_genl_connect() error path (git-fixes).\n- net/mlx5: HWS, fix missing ip_version handling in definer (git-fixes).\n- net/packet: fix a race in packet_set_ring() and packet_notifier() (git-fixes).\n- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (git-fixes).\n- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (git-fixes).\n- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (git-fixes).\n- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (git-fixes).\n- net/sched: sch_qfq: Fix race condition on qfq_aggregate (git-fixes).\n- net/sched: taprio: enforce minimum value for picos_per_byte (git-fixes).\n- net/smc: Fix lookup of netdev by using ib_device_get_netdev() (git-fixes bsc#1246217).\n- net: mana: Add debug logs in MANA network driver (bsc#1246212).\n- net: mana: Add handler for hardware servicing events (bsc#1245730).\n- net: mana: Allocate MSI-X vectors dynamically (bsc#1245457).\n- net: mana: Allow irq_setup() to skip cpus for affinity (bsc#1245457).\n- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (bsc#1246203).\n- net: mana: Expose additional hardware counters for drop and TC via ethtool (bsc#1245729).\n- net: mana: Set tx_packets to post gso processing packet count (bsc#1245731).\n- net: mana: explain irq_setup() algorithm (bsc#1245457).\n- net: phy: Do not register LEDs for genphy (git-fixes).\n- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (git-fixes).\n- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (git-fixes).\n- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (git-fixes).\n- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (git-fixes).\n- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (git-fixes).\n- net: usb: qmi_wwan: add SIMCom 8230C composition (stable-fixes).\n- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (git-fixes).\n- net: usbnet: Fix the wrong netif_carrier_on() call (git-fixes).\n- netlink: fix policy dump for int with validation callback  (jsc#PED-12745).\n- netlink: fix policy dump for int with validation callback (jsc#PED-12745).\n- netlink: specs: devlink: replace underscores with dashes in  names (jsc#PED-12745).\n- netlink: specs: devlink: replace underscores with dashes in names (jsc#PED-12745).\n- netlink: specs: nfsd: replace underscores with dashes in names (git-fixes).\n- netlink: specs: tc: replace underscores with dashes in names (git-fixes).\n- netpoll: prevent hanging NAPI when netcons gets enabled (git-fixes).\n- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (git-fixes).\n- nfs: Fix filehandle bounds checking in nfs_fh_to_dentry() (git-fixes).\n- nfs: Fix the setting of capabilities when automounting a new filesystem (git-fixes).\n- nfs: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (git-fixes).\n- nfs: Fixup allocation flags for nfsiod's __GFP_NORETRY (git-fixes).\n- nfsd: detect mismatch of file handle and delegation stateid in OPEN op (git-fixes).\n- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (git-fixes).\n- nfsv4.2: another fix for listxattr (git-fixes).\n- nfsv4.2: fix listxattr to return selinux security label (git-fixes).\n- nfsv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (git-fixes).\n- nfsv4: Always set NLINK even if the server does not support it (git-fixes).\n- nfsv4: xattr handlers should check for absent nfs filehandles (git-fixes).\n- nilfs2: reject invalid file types when reading inodes (git-fixes).\n- nvme-pci: refresh visible attrs after being checked (git-fixes).\n- nvme: Fix incorrect cdw15 value in passthru error logging (git-fixes).\n- nvme: fix endianness of command word prints in nvme_log_err_passthru() (git-fixes).\n- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (git-fixes).\n- nvme: fix misaccounting of nvme-mpath inflight I/O (git-fixes).\n- nvmet-tcp: fix callback lock for TLS handshake (git-fixes).\n- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (git-fixes).\n- objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks (git-fixes).\n- objtool: Fix _THIS_IP_ detection for cold functions (git-fixes).\n- objtool: Fix error handling inconsistencies in check() (git-fixes).\n- objtool: Ignore dangling jump table entries (git-fixes).\n- objtool: Ignore end-of-section jumps for KCOV/GCOV (git-fixes).\n- objtool: Properly disable uaccess validation (git-fixes).\n- objtool: Silence more KCOV warnings (git-fixes).\n- objtool: Silence more KCOV warnings, part 2 (git-fixes).\n- objtool: Stop UNRET validation on UD2 (git-fixes).\n- pNFS/flexfiles: do not attempt pnfs on fatal DS errors (git-fixes).\n- pch_uart: Fix dma_sync_sg_for_device() nents value (git-fixes).\n- pci/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X allocations (bsc#1245457).\n- pci: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (stable-fixes).\n- pci: endpoint: Fix configfs group list head handling (git-fixes).\n- pci: endpoint: Fix configfs group removal on driver teardown (git-fixes).\n- pci: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (git-fixes).\n- pci: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (git-fixes).\n- pci: hv: Allow dynamic MSI-X vector allocation (bsc#1245457).\n- pci: rockchip-host: Fix 'Unexpected Completion' log message (git-fixes).\n- perf: Fix sample vs do_exit() (bsc#1246547).\n- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (git-fixes).\n- pinctrl: amd: Clear GPIO debounce for suspend (git-fixes).\n- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (git-fixes).\n- pinctrl: sunxi: Fix memory leak on krealloc failure (git-fixes).\n- pinmux: fix race causing mux_owner NULL with active mux_usecount (git-fixes).\n- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (git-fixes).\n- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (git-fixes).\n- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (git-fixes).\n- platform/mellanox: mlxreg-lc: Fix logic error in power state check (git-fixes).\n- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (git-fixes).\n- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (stable-fixes).\n- platform/x86: Fix initialization order for firmware_attributes_class (git-fixes).\n- platform/x86: dell-sysman: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix class device unregistration (git-fixes).\n- platform/x86: firmware_attributes_class: Move include linux/device/class.h (stable-fixes).\n- platform/x86: firmware_attributes_class: Simplify API (stable-fixes).\n- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: hp-bioscfg: Fix class device unregistration (git-fixes).\n- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (git-fixes).\n- platform/x86: make fw_attr_class constant (stable-fixes).\n- platform/x86: think-lmi: Create ksets consecutively (stable-fixes).\n- platform/x86: think-lmi: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: think-lmi: Fix class device unregistration (git-fixes).\n- platform/x86: think-lmi: Fix kobject cleanup (git-fixes).\n- platform/x86: think-lmi: Fix sysfs group cleanup (git-fixes).\n- pm / devfreq: Check governor before using governor-\u003ename (git-fixes).\n- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (git-fixes).\n- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (git-fixes).\n- powercap: call put_device() on an error path in powercap_register_control_type() (stable-fixes).\n- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (git-fixes).\n- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (git-fixes).\n- powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH (git-fixes).\n- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (bsc#1243042 ltc#212167).\n- ptp: fix breakage after ptp_vclock_in_use() rework (bsc#1246506).\n- pwm: imx-tpm: Reset counter if CMOD is 0 (git-fixes).\n- pwm: mediatek: Ensure to disable clocks in error path (git-fixes).\n- pwm: rockchip: Round period/duty down on apply, up on get (git-fixes).\n- rdma/core: Rate limit GID cache warning messages (git-fixes)\n- rdma/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes)\n- rdma/hns: Drop GFP_NOWARN (git-fixes)\n- rdma/hns: Fix -Wframe-larger-than issue (git-fixes)\n- rdma/hns: Fix HW configurations not cleared in error flow (git-fixes)\n- rdma/hns: Fix accessing uninitialized resources (git-fixes)\n- rdma/hns: Fix double destruction of rsv_qp (git-fixes)\n- rdma/hns: Get message length of ack_req from FW (git-fixes)\n- rdma/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes)\n- rdma/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes)\n- rdma/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes)\n- rdma/mlx5: Fix CC counters query for MPV (git-fixes)\n- rdma/mlx5: Fix HW counters query for non-representor devices (git-fixes)\n- rdma/mlx5: Fix UMR modifying of mkey page size (git-fixes)\n- rdma/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes)\n- rdma/mlx5: Fix vport loopback for MPV device (git-fixes)\n- rdma/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert (git-fixes)\n- rdma/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup (git-fixes)\n- rdma/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes)\n- rdma/siw: Fix the sendmsg byte count in siw_tcp_sendpages (git-fixes)\n- rdma/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes)\n- rdma/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes)\n- rdma/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes)\n- rdma/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes)\n- regmap: fix potential memory leak of regmap_bus (git-fixes).\n- regulator: core: fix NULL dereference on unbind due to stale coupling data (stable-fixes).\n- regulator: fan53555: add enable_time support and soft-start times (stable-fixes).\n- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (git-fixes).\n- regulator: pwm-regulator: Calculate the output voltage for disabled PWMs (stable-fixes).\n- resource: fix false warning in __request_region() (git-fixes).\n- restore UCSI_CONNECTOR_RESET_HARD definition (git-fixes).\n- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() (git-fixes).\n- rose: fix dangling neighbour pointers in rose_rt_device_down() (git-fixes).\n- rpl: Fix use-after-free in rpl_do_srh_inline() (git-fixes).\n- rtc: ds1307: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: hym8563: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: nct3018y: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: pcf85063: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: pcf8563: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: rv3028: fix incorrect maximum clock rate handling (git-fixes).\n- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (git-fixes bsc#1246870).\n- s390/entry: Fix last breaking event handling in case of stack corruption (git-fixes bsc#1243806).\n- s390/pci: Do not try re-enabling load/store if device is disabled (git-fixes bsc#1245646).\n- s390/pci: Fix stale function handles in error handling (git-fixes bsc#1245647).\n- s390/pkey: Prevent overflow in size calculation for memdup_user() (git-fixes bsc#1245598).\n- s390: Add z17 elf platform (LTC#214086 bsc#1245540).\n- samples: mei: Fix building on musl libc (git-fixes).\n- sched,freezer: Remove unnecessary warning in __thaw_task (bsc#1219338).\n- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (git-fixes).\n- scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask is set (git-fixes).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1246644).\n- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (git-fixes).\n- scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (git-fixes).\n- scsi: fnic: Set appropriate logging level for log message (bsc#1246644).\n- scsi: fnic: Turn off FDMI ACTIVE flags on link down (git-fixes).\n- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Modify end-of-life adapters' model descriptions (bsc#1245260 bsc#1243100 bsc#1246125 bsc#1204142).\n- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Revise logging format for failed CT MIB requests (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Update debugfs trace ring initialization messages (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Update lpfc version to 14.4.0.10 (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: megaraid_sas: Fix invalid node index (git-fixes).\n- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (git-fixes).\n- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (git-fixes).\n- scsi: s390: zfcp: Ensure synchronous unit_add (git-fixes bsc#1245599).\n- selftests/bpf: Add CFLAGS per source file and runner (git-fixes).\n- selftests/bpf: Add tests for iter next method returning valid pointer (git-fixes).\n- selftests/bpf: Change functions definitions to support GCC (git-fixes).\n- selftests/bpf: Fix a few tests for GCC related warnings (git-fixes).\n- selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect (git-fixes).\n- selftests/bpf: Fix prog numbers in test_sockmap (git-fixes).\n- smb3: move server check earlier when setting channel sequence number (git-fixes).\n- smb3: rename macro CIFS_SERVER_IS_CHAN to avoid confusion (git-fixes).\n- smb3: send channel sequence number in SMB3 requests after reconnects (git-fixes).\n- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (git-fixes).\n- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (git-fixes).\n- soc: aspeed: lpc-snoop: Do not disable channels that are not enabled (git-fixes).\n- soc: qcom: QMI encoding/decoding for big endian (git-fixes).\n- soc: qcom: fix endianness for QMI header (git-fixes).\n- soc: qcom: pmic_glink: fix OF node leak (git-fixes).\n- soundwire: amd: fix for clearing command status register (git-fixes).\n- soundwire: stream: restore params when prepare ports fail (git-fixes).\n- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (git-fixes).\n- sprintf.h requires stdarg.h (git-fixes).\n- sprintf.h: mask additional include (git-fixes).\n- staging: axis-fifo: remove sysfs interface (git-fixes).\n- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (git-fixes).\n- staging: nvec: Fix incorrect null termination of battery manufacturer (git-fixes).\n- staging: vchiq_arm: Make vchiq_shutdown never fail (git-fixes).\n- struct cdns: move new member to the end (git-fixes).\n- struct ucsi_operations: use padding for new operation (git-fixes).\n- sunrpc: do not immediately retransmit on seqno miss (git-fixes).\n- sunrpc: fix client side handling of tls alerts (git-fixes).\n- supported.conf: Mark ZL3073X modules supported\n- supported.conf: add missing entries for armv7hl\n- supported.conf: move nvme-apple to optional again\n- supported.conf: sort entries again\n- tcp: call tcp_measure_rcv_mss() for ooo packets (git-fixes).\n- thermal: trip: Use READ_ONCE() for lockless access to trip properties (git-fixes).\n- thermal: trip: Use common set of trip type names (git-fixes).\n- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (git-fixes).\n- thunderbolt: Fix copy+paste error in match_service_id() (git-fixes).\n- thunderbolt: Fix wake on connect at runtime (git-fixes).\n- tracing/kprobe: Make trace_kprobe's module callback called after jump_label update (git-fixes).\n- tracing/kprobes: Fix to free objects when failed to copy a symbol (git-fixes).\n- types: Complement the aligned types with signed 64-bit one (stable-fixes).\n- ucount: fix atomic_long_inc_below() argument type (git-fixes).\n- ucsi-glink: adapt to kABI consistency (git-fixes).\n- ucsi_ccg: Refine the UCSI Interrupt handling (git-fixes).\n- ucsi_operations: add stubs for all operations (git-fixes).\n- ucsi_ops: adapt update_connector to kABI consistency (git-fixes).\n- usb: Add checks for snprintf() calls in usb_alloc_dev() (stable-fixes).\n- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (git-fixes).\n- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (stable-fixes).\n- usb: cdnsp: Fix issue with CV Bad Descriptor test (git-fixes).\n- usb: cdnsp: Fix issue with resuming from L1 (git-fixes).\n- usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (stable-fixes).\n- usb: cdnsp: do not disable slot for disabled slot (git-fixes).\n- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (git-fixes).\n- usb: common: usb-conn-gpio: use a unique name for usb connector device (stable-fixes).\n- usb: dwc2: also exit clock_gating when stopping udc while suspended (stable-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: meson-g12a: fix device leaks at unbind (git-fixes).\n- usb: early: xhci-dbc: Fix early_ioremap leak (git-fixes).\n- usb: gadget : fix use-after-free in composite_dev_cleanup() (git-fixes).\n- usb: gadget: u_serial: Fix race condition in TTY wakeup (git-fixes).\n- usb: gadget: udc: renesas_usb3: fix device leak at unbind (git-fixes).\n- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (git-fixes).\n- usb: hub: Do not try to recover devices lost during warm reset (git-fixes).\n- usb: misc: apple-mfi-fastcharge: Make power supply names unique (git-fixes).\n- usb: musb: fix gadget state on disconnect (git-fixes).\n- usb: musb: omap2430: fix device leak at unbind (git-fixes).\n- usb: net: sierra: check for no status endpoint (git-fixes).\n- usb: potential integer overflow in usbg_make_tpg() (stable-fixes).\n- usb: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (stable-fixes).\n- usb: serial: option: add Foxconn T99W640 (stable-fixes).\n- usb: serial: option: add Telit Cinterion FE910C04 (ECM) composition (stable-fixes).\n- usb: typec: Update sysfs when setting ops (git-fixes).\n- usb: typec: altmodes/displayport: do not index invalid pin_assignments (git-fixes).\n- usb: typec: displayport: Fix potential deadlock (git-fixes).    \n- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (stable-fixes).\n- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (stable-fixes).\n- usb: typec: tcpm: allow switching to mode accessory to mux properly (stable-fixes).\n- usb: typec: tcpm: allow to use sink in accessory mode (stable-fixes).\n- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (git-fixes).\n- usb: typec: ucsi: Add DATA_RESET option of Connector Reset command (git-fixes).\n- usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk (git-fixes).\n- usb: typec: ucsi: Delay alternate mode discovery (git-fixes).\n- usb: typec: ucsi: Fix busy loop on ASUS VivoBooks (git-fixes).\n- usb: typec: ucsi: Fix the partner PD revision (git-fixes).\n- usb: typec: ucsi: Get PD revision for partner (git-fixes).\n- usb: typec: ucsi: Set orientation as none when connector is unplugged (git-fixes).\n- usb: typec: ucsi: Update power_supply on power role change (git-fixes).\n- usb: typec: ucsi: add callback for connector status updates (git-fixes).\n- usb: typec: ucsi: add update_connector callback (git-fixes).\n- usb: typec: ucsi: do not retrieve PDOs if not supported (git-fixes).\n- usb: typec: ucsi: extract code to read PD caps (git-fixes).\n- usb: typec: ucsi: fix UCSI on SM8550 \u0026 SM8650 Qualcomm devices (git-fixes).\n- usb: typec: ucsi: glink: fix off-by-one in connector_status (git-fixes).\n- usb: typec: ucsi: glink: increase max ports for x1e80100 (git-fixes).\n- usb: typec: ucsi: glink: move GPIO reading into connector_status callback (git-fixes).\n- usb: typec: ucsi: glink: use typec_set_orientation (git-fixes).\n- usb: typec: ucsi: move ucsi_acknowledge() from ucsi_read_error() (git-fixes).\n- usb: typec: ucsi: properly register partner's PD device (git-fixes).\n- usb: typec: ucsi: support delaying GET_PDOS for device (git-fixes).\n- usb: typec: ucsi_acpi: Add LG Gram quirk (git-fixes).\n- usb: typec: ucsi_glink: drop NO_PARTNER_PDOS quirk for sm8550 / sm8650 (git-fixes).\n- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk (git-fixes).\n- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk on qcm6490 (git-fixes).\n- usb: typec: ucsi_glink: rework quirks implementation (git-fixes).\n- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (git-fixes).\n- usb: xhci: quirk for data loss in ISOC transfers (stable-fixes).\n- usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (stable-fixes).\n- virtgpu: do not reset on shutdown (git-fixes).\n- vmci: Prevent the dispatching of uninitialized payloads (git-fixes).\n- vt: add missing notification when switching back to text mode (stable-fixes).\n- vt: defkeymap: Map keycodes above 127 to K_HOLE (git-fixes).\n- vt: keyboard: Do not process Unicode characters in K_OFF mode (git-fixes).\n- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (git-fixes).\n- wifi: ath11k: clear initialized flag for deinit-ed srng lists (git-fixes).\n- wifi: ath11k: fix dest ring-buffer corruption (git-fixes).\n- wifi: ath11k: fix dest ring-buffer corruption when ring is full (git-fixes).\n- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (git-fixes).\n- wifi: ath11k: fix source ring-buffer corruption (git-fixes).\n- wifi: ath11k: fix suspend use-after-free after probe failure (git-fixes).\n- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (git-fixes).\n- wifi: ath12k: fix dest ring-buffer corruption (git-fixes).\n- wifi: ath12k: fix dest ring-buffer corruption when ring is full (git-fixes).\n- wifi: ath12k: fix endianness handling while accessing wmi service bit (git-fixes).\n- wifi: ath12k: fix source ring-buffer corruption (git-fixes).\n- wifi: ath6kl: remove WARN on bad firmware input (stable-fixes).\n- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (git-fixes).\n- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (git-fixes).\n- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (git-fixes).\n- wifi: cfg80211: fix S1G beacon head validation in nl80211 (git-fixes).\n- wifi: cfg80211: remove scan request n_channels counted_by (git-fixes).\n- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (git-fixes).\n- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (git-fixes).\n- wifi: iwlwifi: return ERR_PTR from opmode start() (stable-fixes).\n- wifi: mac80211: Add link iteration macro for link data (stable-fixes).\n- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (git-fixes).\n- wifi: mac80211: Create separate links for VLAN interfaces (stable-fixes).\n- wifi: mac80211: Do not call fq_flow_idx() for management frames (git-fixes).\n- wifi: mac80211: Do not schedule stopped TXQs (git-fixes).\n- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (git-fixes).\n- wifi: mac80211: chan: chandef is non-NULL for reserved (stable-fixes).\n- wifi: mac80211: drop invalid source address OCB frames (stable-fixes).\n- wifi: mac80211: finish link init before RCU publish (git-fixes).\n- wifi: mac80211: fix non-transmitted BSSID profile search (git-fixes).\n- wifi: mac80211: reject TDLS operations when station is not associated (git-fixes).\n- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (git-fixes).\n- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (git-fixes).\n- wifi: mt76: mt7925: fix the wrong config for tx interrupt (git-fixes).\n- wifi: nl80211: Set num_sub_specs before looping through sub_specs (git-fixes).\n- wifi: plfxlc: Fix error handling in usb driver probe (git-fixes).\n- wifi: prevent A-MSDU attacks in mesh networks (stable-fixes).\n- wifi: rt2x00: fix remove callback type mismatch (git-fixes).\n- wifi: rtl818x: Kill URBs before clearing tx status queue (git-fixes).\n- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (git-fixes).\n- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (git-fixes).\n- x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 (bsc#1246449).\n- x86/CPU/AMD: Improve the erratum 1386 workaround (git-fixes).\n- x86/CPU/AMD: Terminate the erratum_1386_microcode array (git-fixes).\n- x86/cpu/amd: Fix workaround for erratum 1054 (git-fixes).\n- x86/cpu: Avoid running off the end of an AMD erratum table (git-fixes).\n- x86/cpu: Expose only stepping min/max interface (git-fixes).\n- x86/cpu: Introduce new microcode matching helper (git-fixes).\n- x86/cpu: Move AMD erratum 1386 table over to 'x86_cpu_id' (git-fixes).\n- x86/cpu: Replace PEBS use of 'x86_cpu_desc' use with 'x86_cpu_id' (git-fixes).\n- x86/mce/amd: Add default names for MCA banks and blocks (git-fixes).\n- x86/mce/amd: Fix threshold limit reset (git-fixes).\n- x86/mce: Do not remove sysfs if thresholding sysfs init fails (git-fixes).\n- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (git-fixes).\n- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (git-fixes).\n- x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).\n- x86/traps: Initialize DR6 by writing its architectural reset value (git-fixes).\n- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (git-fixes).\n- x86: UV RTC: Add parameter to disable RTC clocksource (bsc#1241345).\n- xfs: fix off-by-one error in fsmap's end_daddr usage (bsc#1235837).\n- xfs: only create event xfs_file_compat_ioctl when CONFIG_COMPAT is configure (git-fixes).\n- xfs: remove unused event xfs_alloc_near_error (git-fixes).\n- xfs: remove unused event xfs_alloc_near_nominleft (git-fixes).\n- xfs: remove unused event xfs_attr_node_removename (git-fixes).\n- xfs: remove unused event xfs_ioctl_clone (git-fixes).\n- xfs: remove unused event xfs_pagecache_inval (git-fixes).\n- xfs: remove unused event xlog_iclog_want_sync (git-fixes).\n- xfs: remove unused trace event xfs_attr_remove_iter_return (git-fixes).\n- xfs: remove unused trace event xfs_attr_rmtval_set (git-fixes).\n- xfs: remove unused trace event xfs_reflink_cow_enospc (git-fixes).\n- xfs: remove unused xfs_attr events (git-fixes).\n- xfs: remove unused xfs_reflink_compare_extents events (git-fixes).\n- xfs: remove usused xfs_end_io_direct events (git-fixes).\n- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (git-fixes).\n- xhci: dbc: Flush queued requests before stopping dbc (git-fixes).\n- xhci: dbctty: disable ECHO flag by default (git-fixes).\n","status":"published","published":"2025-08-18T16:01:54Z","modified":"2026-02-04T03:35:26.548367Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02997-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2019-11135: enabled CONFIG_X86_INTEL_TSX_MODE_AUTO (bsc#1139073, bsc#1246695)\n- CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).\n- CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).\n- CVE-2024-39298:mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082).\n- CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664).\n- CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).\n- CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).\n- CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).\n- CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).\n- CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).\n- CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).\n- CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).\n- CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).\n- CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).\n- CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).\n- CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).\n- CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).\n- CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).\n- CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).\n- CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).\n- CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).\n- CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).\n- CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).\n- CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).\n- CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).\n- CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).\n- CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).\n- CVE-2025-38074: vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex (bsc#1244735).\n- CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).\n- CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).\n- CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).\n- CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).\n- CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).\n- CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).\n- CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).\n- CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).\n- CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).\n- CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).\n- CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).\n- CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).\n- CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).\n- CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).\n- CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).\n- CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).\n- CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).\n- CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).\n- CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).\n- CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).\n- CVE-2025-38188: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (bsc#1246098).\n- CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).\n- CVE-2025-38202: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (bsc#1245980).\n- CVE-2025-38203: jfs: Fix null-ptr-deref in jfs_ioc_trim (bsc#1246044).\n- CVE-2025-38204: jfs: fix array-index-out-of-bounds read in add_missing_indices (bsc#1245983).\n- CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).\n- CVE-2025-38210: configfs-tsm-report: Fix NULL dereference of tsm_ops (bsc#1246020).\n- CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).\n- CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).\n- CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).\n- CVE-2025-38236: af_unix: Disable MSG_OOB for unprivileged users (bsc#1246093).\n- CVE-2025-38239: scsi: megaraid_sas: Fix invalid node index (bsc#1246178).\n- CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).\n- CVE-2025-38248: bridge: mcast: Fix use-after-free during router port configuration (bsc#1246173).\n- CVE-2025-38250: kABI workaround for bluetooth hci_dev changes (bsc#1246182).\n- CVE-2025-38256: io_uring/rsrc: fix folio unpinning (bsc#1246188).\n- CVE-2025-38264: llist: add interface to check if a node is on a list (bsc#1246387).\n- CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).\n- CVE-2025-38279: kABI workaround for bpf: Do not include stack ptr register in precision backtracking bookkeeping (bsc#1246264).\n- CVE-2025-38283: hisi_acc_vfio_pci: bugfix live migration function without VF device driver (bsc#1246273).\n- CVE-2025-38303: Bluetooth: eir: Fix possible crashes on eir_create_adv_data (bsc#1246354).\n- CVE-2025-38310: seg6: Fix validation of nexthop addresses (bsc#1246361).\n- CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).\n- CVE-2025-38334: x86/sgx: Prevent attempts to reclaim poisoned pages (bsc#1246384).\n- CVE-2025-38335: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (bsc#1246250).\n- CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).\n- CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).\n- CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).\n- CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).\n- CVE-2025-38364: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (bsc#1247091).\n- CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).\n- CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).\n- CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).\n- CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).\n- CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).\n- CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).\n- CVE-2025-38403: vsock/vmci: Clear the vmci transport packet properly when initializing it (bsc#1247141).\n- CVE-2025-38414: wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (bsc#1247145).\n- CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).\n- CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written (bsc#1247253).\n- CVE-2025-38453: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234).\n- CVE-2025-38455: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (bsc#1247101).\n- CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).\n- CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).\n- CVE-2025-38461: vsock: Fix transport_* TOCTOU (bsc#1247103).\n- CVE-2025-38462: vsock: Fix transport_{g2h,h2g} TOCTOU (bsc#1247104).\n- CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).\n- CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).\n- CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).\n- CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).\n- CVE-2025-38475: smc: Fix various oops due to inet_sock type confusion (bsc#1247308).\n- CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).\n- CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).\n\nThe following non-security bugs were fixed:\n\n- accel/ivpu: Remove copy engine support (stable-fixes).\n- acpi: LPSS: Remove AudioDSP related ID (git-fixes).\n- acpi: PRM: Reduce unnecessary printing to avoid user confusion (bsc#1246122).\n- acpi: processor: perflib: Fix initial _PPC limit application (git-fixes).\n- acpica: Refuse to evaluate a method if arguments are missing (stable-fixes).\n- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (git-fixes).\n- af_unix: Add a prompt to CONFIG_AF_UNIX_OOB (bsc#1246093).\n- alsa: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (git-fixes).\n- alsa: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (stable-fixes).\n- alsa: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (stable-fixes).\n- alsa: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (stable-fixes).\n- alsa: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (git-fixes).\n- alsa: hda/tegra: Add Tegra264 support (stable-fixes).\n- alsa: hda: Add missing NVIDIA HDA codec IDs (stable-fixes).\n- alsa: hda: Add new pci id for AMD GPU display HD audio controller (stable-fixes).\n- alsa: hda: Ignore unsol events for cards being shut down (stable-fixes).\n- alsa: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (git-fixes).\n- alsa: sb: Do not allow changing the DMA mode during operations (stable-fixes).\n- alsa: sb: Force to disable DMAs once when DMA mode is changed (stable-fixes).\n- alsa: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (git-fixes).\n- amd/amdkfd: fix a kfd_process ref leak (stable-fixes).\n- aoe: clean device rq_list in aoedev_downdev() (git-fixes).\n- apple-mfi-fastcharge: protect first device name (git-fixes).\n- asoc: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (stable-fixes).\n- asoc: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (stable-fixes).\n- asoc: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (stable-fixes).\n- asoc: amd: yc: update quirk data for HP Victus (stable-fixes).\n- asoc: codec: wcd9335: Convert to GPIO descriptors (stable-fixes).\n- asoc: codecs: wcd9335: Fix missing free of regulator supplies (git-fixes).\n- asoc: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe() (stable-fixes).\n- asoc: cs35l56: probe() should fail if the device ID is not recognized (git-fixes).\n- asoc: fsl_asrc: use internal measured ratio for non-ideal ratio mode (git-fixes).\n- asoc: fsl_sai: Force a software reset when starting in consumer mode (git-fixes).\n- asoc: fsl_xcvr: get channel status data when PHY is not exists (git-fixes).\n- asoc: mediatek: use reserved memory or enable buffer pre-allocation (git-fixes).\n- asoc: ops: dynamically allocate struct snd_ctl_elem_value (git-fixes).\n- asoc: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (git-fixes).\n- ata: pata_cs5536: fix build on 32-bit UML (stable-fixes).\n- audit,module: restore audit logging in load failure case (git-fixes).\n- bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (git-fixes).\n- bluetooth: HCI: Set extended advertising data synchronously (git-fixes).\n- bluetooth: L2CAP: Fix L2CAP MTU negotiation (stable-fixes).\n- bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (git-fixes).\n- bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT (git-fixes).\n- bluetooth: MGMT: mesh_send: check instances prior disabling advertising (git-fixes).\n- bluetooth: MGMT: set_mesh: update LE scan interval and window (git-fixes).\n- bluetooth: Prevent unintended pause by checking if advertising is active (git-fixes).\n- bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (git-fixes).\n- bluetooth: SMP: If an unallowed command is received consider it a failure (git-fixes).\n- bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (git-fixes).\n- bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (git-fixes).\n- bluetooth: hci_conn: Fix sending BT_HCI_CMD_LE_CREATE_CONN_CANCEL (git-fixes).\n- bluetooth: hci_core: add missing braces when using macro parameters (git-fixes).\n- bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (git-fixes).\n- bluetooth: hci_event: Mask data status from LE ext adv reports (git-fixes).\n- bluetooth: hci_sync: Attempt to dequeue connection attempt (git-fixes).\n- bluetooth: hci_sync: Fix UAF on create_le_conn_complete (git-fixes).\n- bluetooth: hci_sync: Fix handling of HCI_OP_CREATE_CONN_CANCEL (git-fixes).\n- bluetooth: hci_sync: Fix not disabling advertising instance (git-fixes).\n- bluetooth: hci_sync: fix connectable extended advertising when using static random address (git-fixes).\n- bluetooth: hci_sync: revert some mesh modifications (git-fixes).\n- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (git-fixes).\n- bonding: Correctly support GSO ESP offload (git-fixes).\n- bpf, sockmap: Fix sk_msg_reset_curr (git-fixes).\n- bpf/lpm_trie: Inline longest_prefix_match for fastpath (git-fixes).\n- bpf/selftests: Check errno when percpu map value size exceeds (git-fixes).\n- bpf: Add a possibly-zero-sized read test (git-fixes).\n- bpf: Avoid __hidden__ attribute in static object (git-fixes).\n- bpf: Check percpu map value size first (git-fixes).\n- bpf: Disable some `attribute ignored' warnings in GCC (git-fixes).\n- bpf: Fix memory leak in bpf_core_apply (git-fixes).\n- bpf: Fix potential integer overflow in resolve_btfids (git-fixes).\n- bpf: Harden __bpf_kfunc tag against linker kfunc removal (git-fixes).\n- bpf: Make the pointer returned by iter next method valid (git-fixes).\n- bpf: Simplify checking size of helper accesses (git-fixes).\n- bpf: fix order of args in call to bpf_map_kvcalloc (git-fixes).\n- bpf: sockmap, updating the sg structure should also update curr (git-fixes).\n- bpftool: Fix missing pids during link show (git-fixes).\n- bpftool: Fix undefined behavior caused by shifting into the sign bit (git-fixes).\n- bpftool: Mount bpffs on provided dir instead of parent dir (git-fixes).\n- bpftool: Remove unnecessary source files from bootstrap version (git-fixes).\n- bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer (git-fixes).\n- btrfs: do not ignore inode missing when replaying log tree (git-fixes).\n- btrfs: do not silently ignore unexpected extent type when replaying log (git-fixes).\n- btrfs: do not skip remaining extrefs if dir not found during log replay (git-fixes).\n- btrfs: explicitly ref count block_group on new_bgs list (bsc#1243068)\n- btrfs: fix assertion when building free space tree (git-fixes).\n- btrfs: fix inode lookup error handling during log replay (git-fixes).\n- btrfs: fix invalid inode pointer dereferences during log replay (git-fixes).\n- btrfs: fix log tree replay failure due to file with 0 links and extents (git-fixes).\n- btrfs: fix missing error handling when searching for inode refs during log replay (git-fixes).\n- btrfs: fix non-empty delayed iputs list on unmount due to async workers (git-fixes).\n- btrfs: fix ssd_spread overallocation (git-fixes).\n- btrfs: make btrfs_discard_workfn() block_group ref explicit (bsc#1243068)\n- btrfs: propagate last_unlink_trans earlier when doing a rmdir (git-fixes).\n- btrfs: rename err to ret in btrfs_rmdir() (git-fixes).\n- btrfs: return a btrfs_inode from btrfs_iget_logging() (git-fixes).\n- btrfs: return a btrfs_inode from read_one_inode() (git-fixes).\n- btrfs: tests: fix chunk map leak after failure to add it to the tree (git-fixes).\n- btrfs: update superblock's device bytes_used when dropping chunk (git-fixes).\n- btrfs: use NOFS context when getting inodes during logging and log replay (git-fixes).\n- btrfs: use btrfs_record_snapshot_destroy() during rmdir (git-fixes).\n- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (git-fixes).\n- bus: mhi: host: Detect events pointing to unexpected TREs (git-fixes).\n- can: dev: can_restart(): move debug message and stats after successful restart (stable-fixes).\n- can: dev: can_restart(): reverse logic to remove need for goto (stable-fixes).\n- can: kvaser_pciefd: Store device channel index (git-fixes).\n- can: kvaser_usb: Assign netdev.dev_port based on device channel index (git-fixes).\n- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (git-fixes).\n- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (git-fixes).\n- can: peak_usb: fix USB FD devices potential malfunction (git-fixes).\n- cdc-acm: fix race between initial clearing halt and open (git-fixes).\n- cgroup,freezer: fix incomplete freezing when attaching tasks (bsc#1245789).\n- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (bsc#1241166).\n- cifs: reconnect helper should set reconnect for the right channel (git-fixes).\n- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (git-fixes).\n- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (git-fixes).\n- clk: sunxi-ng: v3s: Fix de clock definition (git-fixes).\n- clk: xilinx: vcu: unregister pll_post only if registered correctly (git-fixes).\n- clocksource: Scale the watchdog read retries automatically (bsc#1241345 bsc#1244457).\n- clocksource: Set cs_watchdog_read() checks based on .uncertainty_margin (bsc#1241345 bsc#1244457).\n- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (git-fixes).\n- comedi: Fix initialization of data for instructions that write to subdevice (git-fixes).\n- comedi: Fix some signed shift left operations (git-fixes).\n- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (git-fixes).\n- comedi: aio_iiro_16: Fix bit shift out of bounds (git-fixes).\n- comedi: das16m1: Fix bit shift out of bounds (git-fixes).\n- comedi: das6402: Fix bit shift out of bounds (git-fixes).\n- comedi: pcl812: Fix bit shift out of bounds (git-fixes).\n- compiler_types.h: Define __retain for __attribute__((__retain__)) (git-fixes).\n- crypto: arm/aes-neonbs - work around gcc-15 warning (git-fixes).\n- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (git-fixes).\n- crypto: ccp - Fix locking on alloc failure handling (git-fixes).\n- crypto: hkdf - skip TVs with unapproved salt lengths in FIPS mode (bsc#1241200 bsc#1246134).\n- crypto: img-hash - Fix dma_unmap_sg() nents value (git-fixes).\n- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (git-fixes).\n- crypto: keembay - Fix dma_unmap_sg() nents value (git-fixes).\n- crypto: marvell/cesa - Fix engine load inaccuracy (git-fixes).\n- crypto: qat - allow enabling VFs in the absence of IOMMU (git-fixes).\n- crypto: qat - disable ZUC-256 capability for QAT GEN5 (git-fixes).\n- crypto: qat - fix DMA direction for compression on GEN2 devices (git-fixes).\n- crypto: qat - fix seq_file position update in adf_ring_next() (git-fixes).\n- crypto: qat - fix state restore for banks with exceptions (git-fixes).\n- crypto: qat - flush misc workqueue during device shutdown (git-fixes).\n- crypto: qat - use unmanaged allocation for dc_data (git-fixes).\n- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (git-fixes).\n- dax: add a sysfs knob to control memmap_on_memory behavior (bsc#1235515,jsc#PED-12731).\n- dax: add a sysfs knob to control memmap_on_memory behavior (bsc#1235515,jsc#PED-12731).\n- devlink: Add support for u64 parameters (jsc#PED-12745).\n- devlink: Add support for u64 parameters (jsc#PED-12745).\n- devlink: avoid param type value translations (jsc#PED-12745).\n- devlink: avoid param type value translations (jsc#PED-12745).\n- devlink: define enum for attr types of dynamic attributes  (jsc#PED-12745).\n- devlink: define enum for attr types of dynamic attributes (jsc#PED-12745).\n- devlink: introduce devlink_nl_put_u64() (jsc#PED-12745).\n- devlink: introduce devlink_nl_put_u64() (jsc#PED-12745).\n- dm-bufio: fix sched in atomic context (git-fixes).\n- dm-flakey: error all IOs when num_features is absent (git-fixes).\n- dm-flakey: make corrupting read bios work (git-fixes).\n- dm-mirror: fix a tiny race condition (git-fixes).\n- dm-raid: fix variable in journal device check (git-fixes).\n- dm-verity: fix a memory leak if some arguments are specified multiple times (git-fixes).\n- dm: do not change md if dm_table_set_restrictions() fails (git-fixes).\n- dm: free table mempools if not used in __bind (git-fixes).\n- dm: restrict dm device size to 2^63-512 bytes (git-fixes).\n- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (stable-fixes).\n- dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() (git-fixes).\n- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (stable-fixes).\n- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (git-fixes).\n- dmaengine: nbpfaxi: Add missing check after DMA map (git-fixes).\n- dmaengine: nbpfaxi: Fix memory corruption in probe() (git-fixes).\n- dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() (git-fixes).\n- dmaengine: xilinx_dma: Set dma_device directions (stable-fixes).\n- docs/ABI: Fix sysfs-kernel-address_bits path (git-fixes).\n- documentatiion/ABI: add ABI documentation for sys-bus-dax (bsc#1235515,jsc#PED-12731).\n- documentation/ABI: add ABI documentation for sys-bus-dax (bsc#1235515,jsc#PED-12731).\n- documentation: ACPI: Fix parent device references (git-fixes).\n- documentation: usb: gadget: Wrap remaining usage snippets in literal code block (git-fixes).\n- dpll: Add basic Microchip ZL3073x support (jsc#PED-12745).\n- dpll: Add basic Microchip ZL3073x support (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set frequency on pins  (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set frequency on pins (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set priority on input pins  (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set priority on input pins (jsc#PED-12745).\n- dpll: zl3073x: Fetch invariants during probe (jsc#PED-12745).\n- dpll: zl3073x: Fetch invariants during probe (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin selection in manual mode  (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin selection in manual mode (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin state setting in automatic  mode (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin state setting in automatic mode (jsc#PED-12745).\n- dpll: zl3073x: Read DPLL types and pin properties from system  firmware (jsc#PED-12745).\n- dpll: zl3073x: Read DPLL types and pin properties from system firmware (jsc#PED-12745).\n- dpll: zl3073x: Register DPLL devices and pins (jsc#PED-12745).\n- dpll: zl3073x: Register DPLL devices and pins (jsc#PED-12745).\n- drm/amd/display: Check dce_hwseq before dereferencing it (stable-fixes).\n- drm/amd/display: Correct non-OLED pre_T11_delay (stable-fixes).\n- drm/amd/display: Disable CRTC degamma LUT for DCN401 (stable-fixes).\n- drm/amd/display: Do not overwrite dce60_clk_mgr (git-fixes).\n- drm/amd/display: Fix RMCM programming seq errors (stable-fixes).\n- drm/amd/display: Fix mpv playback corruption on weston (stable-fixes).\n- drm/amd/display: Free memory allocation (stable-fixes).\n- drm/amd/display: fix initial backlight brightness calculation (git-fixes).\n- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (git-fixes).\n- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (stable-fixes).\n- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (git-fixes).\n- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/ip_discovery: add missing ip_discovery fw (stable-fixes).\n- drm/amdgpu: Add kicker device detection (stable-fixes).\n- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (stable-fixes).\n- drm/amdgpu: Increase reset counter only on success (stable-fixes).\n- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (git-fixes).\n- drm/amdgpu: Remove nbiov7.9 replay count reporting (git-fixes).\n- drm/amdgpu: Reset the clear flag in buddy during resume (git-fixes).\n- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (stable-fixes).\n- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (stable-fixes).\n- drm/amdkfd: Do not call mmput from MMU notifier callback (git-fixes).\n- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (stable-fixes).\n- drm/amdkfd: Fix race in GWS queue scheduling (stable-fixes).\n- drm/amdkfd: remove gfx 12 trap handler page size cap (stable-fixes).\n- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (git-fixes).\n- drm/bridge: panel: move prepare_prev_first handling to drm_panel_bridge_add_typed (git-fixes).\n- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (git-fixes).\n- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (git-fixes).\n- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (stable-fixes).\n- drm/connector: hdmi: Evaluate limited range after computing format (git-fixes).\n- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (git-fixes).\n- drm/exynos: fimd: Guard display clock control with runtime PM calls (git-fixes).\n- drm/framebuffer: Acquire internal references on GEM handles (git-fixes).\n- drm/gem: Acquire references on GEM handles for framebuffers (stable-fixes).\n- drm/gem: Fix race in drm_gem_handle_create_tail() (stable-fixes).\n- drm/i915/display: Fix dma_fence_wait_timeout() return value handling (git-fixes).\n- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (stable-fixes).\n- drm/i915/gsc: mei interrupt top half should be in irq disabled context (git-fixes).\n- drm/i915/gt: Fix timeline left held on VMA alloc error (git-fixes).\n- drm/i915/selftests: Change mock_request() to return error pointers (git-fixes).\n- drm/imagination: Fix kernel crash when hard resetting the GPU (git-fixes).\n- drm/mediatek: Add wait_event_timeout when disabling plane (git-fixes).\n- drm/mediatek: only announce AFBC if really supported (git-fixes).\n- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (git-fixes).\n- drm/msm: Fix a fence leak in submit error path (stable-fixes).\n- drm/msm: Fix another leak in the submit error path (stable-fixes).\n- drm/nouveau: check ioctl command codes better (git-fixes).\n- drm/panfrost: Fix panfrost device variable name in devfreq (git-fixes).\n- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (git-fixes).\n- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (git-fixes).\n- drm/sched: Increment job count before swapping tail spsc queue (git-fixes).\n- drm/sched: Remove optimization that causes hang when killing dependent jobs (git-fixes).\n- drm/scheduler: signal scheduled fence when kill job (stable-fixes).\n- drm/tegra: nvdec: Fix dma_alloc_coherent error check (git-fixes).\n- drm/ttm: fix error handling in ttm_buffer_object_transfer (git-fixes).\n- drm/v3d: Disable interrupts before resetting the GPU (git-fixes).\n- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (git-fixes).\n- drm/xe/bmg: fix compressed VRAM handling (git-fixes).\n- drm/xe/guc: Dead CT helper (stable-fixes).\n- drm/xe/guc: Explicitly exit CT safe mode on unwind (git-fixes).\n- drm/xe/guc_submit: add back fix (git-fixes).\n- drm/xe/mocs: Initialize MOCS index early (stable-fixes).\n- drm/xe/pf: Clear all LMTT pages on alloc (git-fixes).\n- drm/xe/pf: Move VFs reprovisioning to worker (stable-fixes).\n- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (git-fixes).\n- drm/xe/pf: Sanitize VF scratch registers on FLR (stable-fixes).\n- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (git-fixes).\n- drm/xe/uapi: Correct sync type definition in comments (git-fixes).\n- drm/xe/vf: Disable CSC support on VF (git-fixes).\n- drm/xe: Allocate PF queue size on pow2 boundary (git-fixes).\n- drm/xe: Allow bo mapping on multiple ggtts (stable-fixes).\n- drm/xe: Fix DSB buffer coherency (stable-fixes).\n- drm/xe: Fix build without debugfs (git-fixes).\n- drm/xe: Fix early wedge on GuC load failure (git-fixes).\n- drm/xe: Fix taking invalid lock on wedge (stable-fixes).\n- drm/xe: Move DSB l2 flush to a more sensible place (git-fixes).\n- drm/xe: Replace double space with single space after comma (stable-fixes).\n- drm/xe: add interface to request physical alignment for buffer objects (stable-fixes).\n- drm/xe: move DPT l2 flush to a more sensible place (git-fixes).\n- dt-bindings: dpll: Add DPLL device and pin (jsc#PED-12745).\n- dt-bindings: dpll: Add DPLL device and pin (jsc#PED-12745).\n- dt-bindings: dpll: Add support for Microchip Azurite chip family  (jsc#PED-12745).\n- dt-bindings: dpll: Add support for Microchip Azurite chip family (jsc#PED-12745).\n- e1000: Move cancel_work_sync to avoid deadlock (git-fixes).\n- enable SMC_LO (a.k.a SMC-D) (jsc#PED-13248).\n- exfat: fdatasync flag should be same like generic_write_sync() (git-fixes).\n- fbcon: Fix outdated registered_fb reference in comment (git-fixes).\n- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (git-fixes).\n- firewire: ohci: correct code comments about bus_reset tasklet (git-fixes).\n- fix dma_unmap_sg() nents value (git-fixes)\n- fs/jfs: consolidate sanity checking in dbMount (git-fixes).\n- fs/orangefs: Allow 2 more characters in do_c_string() (git-fixes).\n- gpio: mlxbf2: use platform_get_irq_optional() (git-fixes).\n- gpio: pca953x: log an error when failing to get the reset GPIO (git-fixes).\n- gpio: sim: include a missing header (git-fixes).\n- gpio: vf610: add locking to gpio direction functions (git-fixes).\n- gpio: virtio: Fix config space reading (git-fixes).\n- gpiolib: Fix debug messaging in gpiod_find_and_request() (git-fixes).\n- gpiolib: Handle no pin_ranges in gpiochip_generic_config() (git-fixes).\n- gpiolib: acpi: Do not use GPIO chip fwnode in acpi_gpiochip_find() (bsc#1233300).\n- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match (bsc#1233300).\n- gpiolib: cdev: Ignore reconfiguration without direction (git-fixes).\n- gpiolib: of: Add polarity quirk for s5m8767 (stable-fixes).\n- hfs: make splice write available again (git-fixes).\n- hfsplus: make splice write available again (git-fixes).\n- hfsplus: remove mutex_lock check in hfsplus_free_extents (git-fixes).\n- hid: Add IGNORE quirk for SMARTLINKTECHNOLOGY (stable-fixes).\n- hid: core: do not bypass hid_hw_raw_request (stable-fixes).\n- hid: core: ensure __hid_request reserves the report ID as the first byte (git-fixes).\n- hid: core: ensure the allocated report buffer can contain the reserved report ID (stable-fixes).\n- hid: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (stable-fixes).\n- hid: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (stable-fixes).\n- hv_netvsc: Use VF's tso_max_size value when data path is VF (bsc#1246203).\n- hwmon: (corsair-cpro) Validate the size of the received input buffer (git-fixes).\n- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (git-fixes).\n- hwmon: (pmbus/max34440) Fix support for max34451 (stable-fixes).\n- hwrng: mtk - handle devm_pm_runtime_enable errors (git-fixes).\n- i2c/designware: Fix an initialization issue (git-fixes).\n- i2c: qup: jump out of the loop in case of timeout (git-fixes).\n- i2c: stm32: fix the device used for the DMA map (git-fixes).\n- i2c: tegra: Fix reset error handling with ACPI (git-fixes).\n- i2c: virtio: Avoid hang by using interruptible completion wait (git-fixes).\n- i3c: fix module_i3c_i2c_driver() with I3C=n (git-fixes).\n- ib/mlx5: Fix potential deadlock in MR deregistration (git-fixes)\n- ice, irdma: fix an off by one in error handling code (bsc#1247712).\n- ice, irdma: move interrupts code to irdma (bsc#1247712).\n- ice: Fix signedness bug in ice_init_interrupt_scheme() (bsc#1247712).\n- ice: count combined queues using Rx/Tx count (bsc#1247712).\n- ice: devlink PF MSI-X max and min parameter (bsc#1247712).\n- ice: enable_rdma devlink param (bsc#1247712).\n- ice: fix eswitch code memory leak in reset scenario (git-fixes).\n- ice: get rid of num_lan_msix field (bsc#1247712).\n- ice: init flow director before RDMA (bsc#1247712).\n- ice: remove splitting MSI-X between features (bsc#1247712).\n- ice: simplify VF MSI-X managing (bsc#1247712).\n- ice: treat dyn_allowed only as suggestion (bsc#1247712).\n- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (git-fixes).\n- iio: adc: ad7949: use spi_is_bpw_supported() (git-fixes).\n- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (stable-fixes).\n- iio: adc: ad_sigma_delta: change to buffer predisable (git-fixes).\n- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (stable-fixes).\n- iio: adc: max1363: Reorder mode_list[] entries (stable-fixes).\n- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (git-fixes).\n- iio: imu: bno055: fix OOB access of hw_xlate array (git-fixes).\n- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (stable-fixes).\n- input: iqs7222 - explicitly define number of external channels (git-fixes).\n- input: xpad - adjust error handling for disconnect (git-fixes).\n- input: xpad - set correct controller type for Acer NGR200 (git-fixes).\n- input: xpad - support Acer NGR 200 Controller (stable-fixes).\n- io_uring/timeout: fix multishot updates (bsc#1247021).\n- io_uring: fix potential page leak in io_sqe_buffer_register() (git-fixes).\n- iommu/amd: Fix geometry.aperture_end for V2 tables (git-fixes).\n- iommu/amd: Set the pgsize_bitmap correctly (git-fixes).\n- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (git-fixes).\n- iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding (git-fixes).\n- iommu/vt-d: Fix possible circular locking dependency (git-fixes).\n- iommu/vt-d: Fix system hang on reboot -f (git-fixes).\n- ipv6: fix possible infinite loop in fib6_info_uses_dev() (git-fixes).\n- ipv6: mcast: Delay put pmc-\u003eidev in mld_del_delrec() (git-fixes).\n- ipv6: prevent infinite loop in rt6_nlmsg_size() (git-fixes).\n- ipv6: reject malicious packets in ipv6_gso_segment() (git-fixes).\n- irdma: free iwdev-\u003erf after removing MSI-X (bsc#1247712).\n- iwlwifi: Add missing check for alloc_ordered_workqueue (git-fixes).\n- jfs: fix metapage reference count leak in dbAllocCtl (git-fixes).\n- kABI fix after KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).\n- kABI fixes for struct memory_block changes  (bsc#1235515,jsc#PED-12731).\n- kABI fixes for struct memory_block changes (bsc#1235515,jsc#PED-12731).\n- kABI workaround for fw_attributes_class_get() (stable-fixes).\n- kABI workaround for struct drm_framebuffer changes (git-fixes).\n- kABI: Fix the module::name type in audit_context (git-fixes).\n- kabi/severities: ignore two unused/dropped symbols from MEI\n- kabi: Hide adding of u64 to devlink_param_type (jsc#PED-12745).\n- kabi: Hide adding of u64 to devlink_param_type (jsc#PED-12745).\n- kasan: remove kasan_find_vm_area() to prevent possible deadlock (git-fixes).\n- kernel-obs-qa: Do not depend on srchash when qemu emulation is used In this case the dependency is never fulfilled Fixes: 485ae1da2b88 ('kernel-obs-qa: Use srchash for dependency as well')\n- kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).\n- kvm: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).\n- leds: multicolor: Fix intensity setting while SW blinking (stable-fixes).\n- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (bsc#1236897).\n- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (bsc#1236897).\n- logitech C-270 even more broken (stable-fixes).\n- maple_tree: fix mt_destroy_walk() on root leaf node (git-fixes).\n- md/md-bitmap: fix dm-raid max_write_behind setting (git-fixes).\n- media: gspca: Add bounds checking to firmware parser (git-fixes).\n- media: hi556: correct the test pattern configuration (git-fixes).\n- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (git-fixes).\n- media: ipu6: isys: Use correct pads for xlate_streams() (git-fixes).\n- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (git-fixes).\n- media: ov2659: Fix memory leaks in ov2659_probe() (git-fixes).\n- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (git-fixes).\n- media: usbtv: Lock resolution while streaming (git-fixes).\n- media: uvcvideo: Do not mark valid metadata as invalid (git-fixes).\n- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (git-fixes).\n- media: v4l2-ctrls: Do not reset handler's error in v4l2_ctrl_handler_free() (git-fixes).\n- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (git-fixes).\n- media: venus: Add a check for packet size after reading from shared memory (git-fixes).\n- media: venus: hfi: explicitly release IRQ during teardown (git-fixes).\n- media: venus: protect against spurious interrupts during probe (git-fixes).\n- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240 (git-fixes).\n- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (git-fixes).\n- media: verisilicon: Fix AV1 decoder clock frequency (git-fixes).\n- media: vivid: fix wrong pixel_array control size (git-fixes).\n- mei: vsc: Destroy mutex after freeing the IRQ (git-fixes).\n- mei: vsc: Do not re-init VSC from mei_vsc_hw_reset() on stop (git-fixes).\n- mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq() (stable-fixes).\n- mei: vsc: Event notifier fixes (git-fixes).\n- mei: vsc: Fix 'BUG: Invalid wait context' lockdep error (git-fixes).\n- mei: vsc: Run event callback from a workqueue (git-fixes).\n- mei: vsc: Unset the event callback on remove and probe errors (git-fixes).\n- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (git-fixes).\n- mfd: max14577: Fix wakeup source leaks on device unbind (stable-fixes).\n- misc: rtsx: usb: Ensure mmc child device is active when card is present (git-fixes).\n- mm/memory_hotplug: allow architecture to override memmap on  memory support check (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow architecture to override memmap on memory support check (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow memmap on memory hotplug request to  fallback (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow memmap on memory hotplug request to fallback (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: embed vmem_altmap details in memory block  (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: embed vmem_altmap details in memory block (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: export mhp_supports_memmap_on_memory() (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: export mhp_supports_memmap_on_memory() (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval (git-fixes).\n- mm/memory_hotplug: replace an open-coded kmemdup() in (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: replace an open-coded kmemdup() in (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: simplify ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE  kconfig (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: simplify ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE kconfig (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: split memmap_on_memory requests across memblocks (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: split memmap_on_memory requests across memblocks (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: support memmap_on_memory when memmap is  not aligned to pageblocks (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: support memmap_on_memory when memmap is not aligned to pageblocks (bsc#1235515,jsc#PED-12731).\n- mmc: bcm2835: Fix dma_unmap_sg() nents value (git-fixes).\n- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (git-fixes).\n- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (git-fixes).\n- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (stable-fixes).\n- mmc: sdhci_am654: Workaround for Errata i2312 (git-fixes).\n- module: Fix memory deallocation on error path in move_module() (git-fixes).\n- module: Remove unnecessary +1 from last_unloaded_module::name size (git-fixes).\n- module: Restore the moduleparam prefix length check (git-fixes).\n- mtd: fix possible integer overflow in erase_xfer() (git-fixes).\n- mtd: rawnand: atmel: Fix dma_mapping_error() address (git-fixes).\n- mtd: rawnand: atmel: set pmecc data setup time (git-fixes).\n- mtd: rawnand: fsmc: Add missing check after DMA map (git-fixes).\n- mtd: rawnand: renesas: Add missing check after DMA map (git-fixes).\n- mtd: rawnand: rockchip: Add missing check after DMA map (git-fixes).\n- mtd: spi-nor: Fix spi_nor_try_unlock_all() (git-fixes).\n- mtd: spinand: fix memory leak of ECC engine conf (stable-fixes).\n- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (git-fixes).\n- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (git-fixes).\n- mtk-sd: Prevent memory corruption from DMA map failure (git-fixes).\n- mtk-sd: reset host-\u003emrq on prepare_data() error (git-fixes).\n- mwl8k: Add missing check after DMA map (git-fixes).\n- nbd: fix uaf in nbd_genl_connect() error path (git-fixes).\n- net/mlx5: HWS, fix missing ip_version handling in definer (git-fixes).\n- net/packet: fix a race in packet_set_ring() and packet_notifier() (git-fixes).\n- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (git-fixes).\n- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (git-fixes).\n- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (git-fixes).\n- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (git-fixes).\n- net/sched: sch_qfq: Fix race condition on qfq_aggregate (git-fixes).\n- net/sched: taprio: enforce minimum value for picos_per_byte (git-fixes).\n- net/smc: Fix lookup of netdev by using ib_device_get_netdev() (git-fixes bsc#1246217).\n- net: mana: Add debug logs in MANA network driver (bsc#1246212).\n- net: mana: Add handler for hardware servicing events (bsc#1245730).\n- net: mana: Allocate MSI-X vectors dynamically (bsc#1245457).\n- net: mana: Allow irq_setup() to skip cpus for affinity (bsc#1245457).\n- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (bsc#1246203).\n- net: mana: Expose additional hardware counters for drop and TC via ethtool (bsc#1245729).\n- net: mana: Set tx_packets to post gso processing packet count (bsc#1245731).\n- net: mana: explain irq_setup() algorithm (bsc#1245457).\n- net: phy: Do not register LEDs for genphy (git-fixes).\n- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (git-fixes).\n- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (git-fixes).\n- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (git-fixes).\n- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (git-fixes).\n- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (git-fixes).\n- net: usb: qmi_wwan: add SIMCom 8230C composition (stable-fixes).\n- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (git-fixes).\n- net: usbnet: Fix the wrong netif_carrier_on() call (git-fixes).\n- netlink: fix policy dump for int with validation callback  (jsc#PED-12745).\n- netlink: fix policy dump for int with validation callback (jsc#PED-12745).\n- netlink: specs: devlink: replace underscores with dashes in  names (jsc#PED-12745).\n- netlink: specs: devlink: replace underscores with dashes in names (jsc#PED-12745).\n- netlink: specs: nfsd: replace underscores with dashes in names (git-fixes).\n- netlink: specs: tc: replace underscores with dashes in names (git-fixes).\n- netpoll: prevent hanging NAPI when netcons gets enabled (git-fixes).\n- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (git-fixes).\n- nfs: Fix filehandle bounds checking in nfs_fh_to_dentry() (git-fixes).\n- nfs: Fix the setting of capabilities when automounting a new filesystem (git-fixes).\n- nfs: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (git-fixes).\n- nfs: Fixup allocation flags for nfsiod's __GFP_NORETRY (git-fixes).\n- nfsd: detect mismatch of file handle and delegation stateid in OPEN op (git-fixes).\n- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (git-fixes).\n- nfsv4.2: another fix for listxattr (git-fixes).\n- nfsv4.2: fix listxattr to return selinux security label (git-fixes).\n- nfsv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (git-fixes).\n- nfsv4: Always set NLINK even if the server does not support it (git-fixes).\n- nfsv4: xattr handlers should check for absent nfs filehandles (git-fixes).\n- nilfs2: reject invalid file types when reading inodes (git-fixes).\n- nvme-pci: refresh visible attrs after being checked (git-fixes).\n- nvme: Fix incorrect cdw15 value in passthru error logging (git-fixes).\n- nvme: fix endianness of command word prints in nvme_log_err_passthru() (git-fixes).\n- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (git-fixes).\n- nvme: fix misaccounting of nvme-mpath inflight I/O (git-fixes).\n- nvmet-tcp: fix callback lock for TLS handshake (git-fixes).\n- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (git-fixes).\n- objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks (git-fixes).\n- objtool: Fix _THIS_IP_ detection for cold functions (git-fixes).\n- objtool: Fix error handling inconsistencies in check() (git-fixes).\n- objtool: Ignore dangling jump table entries (git-fixes).\n- objtool: Ignore end-of-section jumps for KCOV/GCOV (git-fixes).\n- objtool: Properly disable uaccess validation (git-fixes).\n- objtool: Silence more KCOV warnings (git-fixes).\n- objtool: Silence more KCOV warnings, part 2 (git-fixes).\n- objtool: Stop UNRET validation on UD2 (git-fixes).\n- pNFS/flexfiles: do not attempt pnfs on fatal DS errors (git-fixes).\n- pch_uart: Fix dma_sync_sg_for_device() nents value (git-fixes).\n- pci/msi: Export pci_msix_prepare_desc() for dynamic MSI-X allocations (bsc#1245457).\n- pci: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (stable-fixes).\n- pci: endpoint: Fix configfs group list head handling (git-fixes).\n- pci: endpoint: Fix configfs group removal on driver teardown (git-fixes).\n- pci: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (git-fixes).\n- pci: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (git-fixes).\n- pci: hv: Allow dynamic MSI-X vector allocation (bsc#1245457).\n- pci: rockchip-host: Fix 'Unexpected Completion' log message (git-fixes).\n- perf: Fix sample vs do_exit() (bsc#1246547).\n- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (git-fixes).\n- pinctrl: amd: Clear GPIO debounce for suspend (git-fixes).\n- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (git-fixes).\n- pinctrl: sunxi: Fix memory leak on krealloc failure (git-fixes).\n- pinmux: fix race causing mux_owner NULL with active mux_usecount (git-fixes).\n- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (git-fixes).\n- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (git-fixes).\n- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (git-fixes).\n- platform/mellanox: mlxreg-lc: Fix logic error in power state check (git-fixes).\n- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (git-fixes).\n- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (stable-fixes).\n- platform/x86: Fix initialization order for firmware_attributes_class (git-fixes).\n- platform/x86: dell-sysman: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix class device unregistration (git-fixes).\n- platform/x86: firmware_attributes_class: Move include linux/device/class.h (stable-fixes).\n- platform/x86: firmware_attributes_class: Simplify API (stable-fixes).\n- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: hp-bioscfg: Fix class device unregistration (git-fixes).\n- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (git-fixes).\n- platform/x86: make fw_attr_class constant (stable-fixes).\n- platform/x86: think-lmi: Create ksets consecutively (stable-fixes).\n- platform/x86: think-lmi: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: think-lmi: Fix class device unregistration (git-fixes).\n- platform/x86: think-lmi: Fix kobject cleanup (git-fixes).\n- platform/x86: think-lmi: Fix sysfs group cleanup (git-fixes).\n- pm / devfreq: Check governor before using governor-\u003ename (git-fixes).\n- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (git-fixes).\n- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (git-fixes).\n- powercap: call put_device() on an error path in powercap_register_control_type() (stable-fixes).\n- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (git-fixes).\n- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (git-fixes).\n- powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH (git-fixes).\n- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (bsc#1243042 ltc#212167).\n- ptp: fix breakage after ptp_vclock_in_use() rework (bsc#1246506).\n- pwm: imx-tpm: Reset counter if CMOD is 0 (git-fixes).\n- pwm: mediatek: Ensure to disable clocks in error path (git-fixes).\n- pwm: rockchip: Round period/duty down on apply, up on get (git-fixes).\n- rdma/core: Rate limit GID cache warning messages (git-fixes)\n- rdma/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes)\n- rdma/hns: Drop GFP_NOWARN (git-fixes)\n- rdma/hns: Fix -Wframe-larger-than issue (git-fixes)\n- rdma/hns: Fix HW configurations not cleared in error flow (git-fixes)\n- rdma/hns: Fix accessing uninitialized resources (git-fixes)\n- rdma/hns: Fix double destruction of rsv_qp (git-fixes)\n- rdma/hns: Get message length of ack_req from FW (git-fixes)\n- rdma/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes)\n- rdma/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes)\n- rdma/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes)\n- rdma/mlx5: Fix CC counters query for MPV (git-fixes)\n- rdma/mlx5: Fix HW counters query for non-representor devices (git-fixes)\n- rdma/mlx5: Fix UMR modifying of mkey page size (git-fixes)\n- rdma/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes)\n- rdma/mlx5: Fix vport loopback for MPV device (git-fixes)\n- rdma/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert (git-fixes)\n- rdma/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup (git-fixes)\n- rdma/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes)\n- rdma/siw: Fix the sendmsg byte count in siw_tcp_sendpages (git-fixes)\n- rdma/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes)\n- rdma/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes)\n- rdma/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes)\n- rdma/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes)\n- re-enable qmi_wwan for arm64 (bsc#1246113)\n- reapply 'wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()' (git-fixes).\n- regmap: fix potential memory leak of regmap_bus (git-fixes).\n- regulator: core: fix NULL dereference on unbind due to stale coupling data (stable-fixes).\n- regulator: fan53555: add enable_time support and soft-start times (stable-fixes).\n- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (git-fixes).\n- regulator: pwm-regulator: Calculate the output voltage for disabled PWMs (stable-fixes).\n- resource: fix false warning in __request_region() (git-fixes).\n- restore UCSI_CONNECTOR_RESET_HARD definition (git-fixes).\n- revert 'ACPI: battery: negate current when discharging' (stable-fixes).\n- revert 'cgroup_freezer: cgroup_freezing: Check if not frozen' (bsc#1219338).\n- revert 'drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1' (stable-fixes).\n- revert 'drm/nouveau: check ioctl command codes better' (git-fixes).\n- revert 'drm/xe/xe2: Enable Indirect Ring State support for Xe2' (git-fixes).\n- revert 'mmc: sdhci: Disable SD card clock before changing parameters' (git-fixes).\n- revert 'usb: xhci: Implement xhci_handshake_check_state() helper' (git-fixes).\n- revert 'vgacon: Add check for vc_origin address range in vgacon_scroll()' (stable-fixes).\n- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() (git-fixes).\n- rose: fix dangling neighbour pointers in rose_rt_device_down() (git-fixes).\n- rpl: Fix use-after-free in rpl_do_srh_inline() (git-fixes).\n- rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879) Put the same workaround to avoid file truncation of vmlinux and co in kernel-default-base package, too.\n- rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)\n- rtc: ds1307: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: hym8563: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: nct3018y: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: pcf85063: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: pcf8563: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: rv3028: fix incorrect maximum clock rate handling (git-fixes).\n- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (git-fixes bsc#1246870).\n- s390/entry: Fix last breaking event handling in case of stack corruption (git-fixes bsc#1243806).\n- s390/pci: Do not try re-enabling load/store if device is disabled (git-fixes bsc#1245646).\n- s390/pci: Fix stale function handles in error handling (git-fixes bsc#1245647).\n- s390/pkey: Prevent overflow in size calculation for memdup_user() (git-fixes bsc#1245598).\n- s390: Add z17 elf platform (LTC#214086 bsc#1245540).\n- samples: mei: Fix building on musl libc (git-fixes).\n- sched,freezer: Remove unnecessary warning in __thaw_task (bsc#1219338).\n- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (git-fixes).\n- scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask is set (git-fixes).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1246644).\n- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (git-fixes).\n- scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (git-fixes).\n- scsi: fnic: Set appropriate logging level for log message (bsc#1246644).\n- scsi: fnic: Turn off FDMI ACTIVE flags on link down (git-fixes).\n- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Modify end-of-life adapters' model descriptions (bsc#1245260 bsc#1243100 bsc#1246125 bsc#1204142).\n- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Revise logging format for failed CT MIB requests (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Update debugfs trace ring initialization messages (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Update lpfc version to 14.4.0.10 (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: megaraid_sas: Fix invalid node index (git-fixes).\n- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (git-fixes).\n- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (git-fixes).\n- scsi: s390: zfcp: Ensure synchronous unit_add (git-fixes bsc#1245599).\n- selftests/bpf: Add CFLAGS per source file and runner (git-fixes).\n- selftests/bpf: Add tests for iter next method returning valid pointer (git-fixes).\n- selftests/bpf: Change functions definitions to support GCC (git-fixes).\n- selftests/bpf: Fix a few tests for GCC related warnings (git-fixes).\n- selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect (git-fixes).\n- selftests/bpf: Fix prog numbers in test_sockmap (git-fixes).\n- smb3: move server check earlier when setting channel sequence number (git-fixes).\n- smb3: rename macro CIFS_SERVER_IS_CHAN to avoid confusion (git-fixes).\n- smb3: send channel sequence number in SMB3 requests after reconnects (git-fixes).\n- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (git-fixes).\n- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (git-fixes).\n- soc: aspeed: lpc-snoop: Do not disable channels that are not enabled (git-fixes).\n- soc: qcom: QMI encoding/decoding for big endian (git-fixes).\n- soc: qcom: fix endianness for QMI header (git-fixes).\n- soc: qcom: pmic_glink: fix OF node leak (git-fixes).\n- soundwire: amd: fix for clearing command status register (git-fixes).\n- soundwire: stream: restore params when prepare ports fail (git-fixes).\n- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (git-fixes).\n- sprintf.h requires stdarg.h (git-fixes).\n- sprintf.h: mask additional include (git-fixes).\n- staging: axis-fifo: remove sysfs interface (git-fixes).\n- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (git-fixes).\n- staging: nvec: Fix incorrect null termination of battery manufacturer (git-fixes).\n- staging: vchiq_arm: Make vchiq_shutdown never fail (git-fixes).\n- struct cdns: move new member to the end (git-fixes).\n- struct ucsi_operations: use padding for new operation (git-fixes).\n- sunrpc: do not immediately retransmit on seqno miss (git-fixes).\n- sunrpc: fix client side handling of tls alerts (git-fixes).\n- supported.conf: Mark ZL3073X modules supported\n- supported.conf: add missing entries for armv7hl\n- supported.conf: move nvme-apple to optional again\n- supported.conf: sort entries again\n- tcp: call tcp_measure_rcv_mss() for ooo packets (git-fixes).\n- thermal: trip: Use READ_ONCE() for lockless access to trip properties (git-fixes).\n- thermal: trip: Use common set of trip type names (git-fixes).\n- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (git-fixes).\n- thunderbolt: Fix copy+paste error in match_service_id() (git-fixes).\n- thunderbolt: Fix wake on connect at runtime (git-fixes).\n- tracing/kprobe: Make trace_kprobe's module callback called after jump_label update (git-fixes).\n- tracing/kprobes: Fix to free objects when failed to copy a symbol (git-fixes).\n- types: Complement the aligned types with signed 64-bit one (stable-fixes).\n- ucount: fix atomic_long_inc_below() argument type (git-fixes).\n- ucsi-glink: adapt to kABI consistency (git-fixes).\n- ucsi_ccg: Refine the UCSI Interrupt handling (git-fixes).\n- ucsi_operations: add stubs for all operations (git-fixes).\n- ucsi_ops: adapt update_connector to kABI consistency (git-fixes).\n- update config files (bsc#1243678)\n- usb: Add checks for snprintf() calls in usb_alloc_dev() (stable-fixes).\n- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (git-fixes).\n- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (stable-fixes).\n- usb: cdnsp: Fix issue with CV Bad Descriptor test (git-fixes).\n- usb: cdnsp: Fix issue with resuming from L1 (git-fixes).\n- usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (stable-fixes).\n- usb: cdnsp: do not disable slot for disabled slot (git-fixes).\n- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (git-fixes).\n- usb: common: usb-conn-gpio: use a unique name for usb connector device (stable-fixes).\n- usb: dwc2: also exit clock_gating when stopping udc while suspended (stable-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: meson-g12a: fix device leaks at unbind (git-fixes).\n- usb: early: xhci-dbc: Fix early_ioremap leak (git-fixes).\n- usb: gadget : fix use-after-free in composite_dev_cleanup() (git-fixes).\n- usb: gadget: u_serial: Fix race condition in TTY wakeup (git-fixes).\n- usb: gadget: udc: renesas_usb3: fix device leak at unbind (git-fixes).\n- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (git-fixes).\n- usb: hub: Do not try to recover devices lost during warm reset (git-fixes).\n- usb: misc: apple-mfi-fastcharge: Make power supply names unique (git-fixes).\n- usb: musb: fix gadget state on disconnect (git-fixes).\n- usb: musb: omap2430: fix device leak at unbind (git-fixes).\n- usb: net: sierra: check for no status endpoint (git-fixes).\n- usb: potential integer overflow in usbg_make_tpg() (stable-fixes).\n- usb: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (stable-fixes).\n- usb: serial: option: add Foxconn T99W640 (stable-fixes).\n- usb: serial: option: add Telit Cinterion FE910C04 (ECM) composition (stable-fixes).\n- usb: typec: Update sysfs when setting ops (git-fixes).\n- usb: typec: altmodes/displayport: do not index invalid pin_assignments (git-fixes).\n- usb: typec: displayport: Fix potential deadlock (git-fixes).\n- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (stable-fixes).\n- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (stable-fixes).\n- usb: typec: tcpm: allow switching to mode accessory to mux properly (stable-fixes).\n- usb: typec: tcpm: allow to use sink in accessory mode (stable-fixes).\n- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (git-fixes).\n- usb: typec: ucsi: Add DATA_RESET option of Connector Reset command (git-fixes).\n- usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk (git-fixes).\n- usb: typec: ucsi: Delay alternate mode discovery (git-fixes).\n- usb: typec: ucsi: Fix busy loop on ASUS VivoBooks (git-fixes).\n- usb: typec: ucsi: Fix the partner PD revision (git-fixes).\n- usb: typec: ucsi: Get PD revision for partner (git-fixes).\n- usb: typec: ucsi: Set orientation as none when connector is unplugged (git-fixes).\n- usb: typec: ucsi: Update power_supply on power role change (git-fixes).\n- usb: typec: ucsi: add callback for connector status updates (git-fixes).\n- usb: typec: ucsi: add update_connector callback (git-fixes).\n- usb: typec: ucsi: do not retrieve PDOs if not supported (git-fixes).\n- usb: typec: ucsi: extract code to read PD caps (git-fixes).\n- usb: typec: ucsi: fix UCSI on SM8550 \u0026 SM8650 Qualcomm devices (git-fixes).\n- usb: typec: ucsi: glink: fix off-by-one in connector_status (git-fixes).\n- usb: typec: ucsi: glink: increase max ports for x1e80100 (git-fixes).\n- usb: typec: ucsi: glink: move GPIO reading into connector_status callback (git-fixes).\n- usb: typec: ucsi: glink: use typec_set_orientation (git-fixes).\n- usb: typec: ucsi: move ucsi_acknowledge() from ucsi_read_error() (git-fixes).\n- usb: typec: ucsi: properly register partner's PD device (git-fixes).\n- usb: typec: ucsi: support delaying GET_PDOS for device (git-fixes).\n- usb: typec: ucsi_acpi: Add LG Gram quirk (git-fixes).\n- usb: typec: ucsi_glink: drop NO_PARTNER_PDOS quirk for sm8550 / sm8650 (git-fixes).\n- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk (git-fixes).\n- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk on qcm6490 (git-fixes).\n- usb: typec: ucsi_glink: rework quirks implementation (git-fixes).\n- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (git-fixes).\n- usb: xhci: quirk for data loss in ISOC transfers (stable-fixes).\n- usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (stable-fixes).\n- virtgpu: do not reset on shutdown (git-fixes).\n- vmci: Prevent the dispatching of uninitialized payloads (git-fixes).\n- vt: add missing notification when switching back to text mode (stable-fixes).\n- vt: defkeymap: Map keycodes above 127 to K_HOLE (git-fixes).\n- vt: keyboard: Do not process Unicode characters in K_OFF mode (git-fixes).\n- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (git-fixes).\n- wifi: ath11k: clear initialized flag for deinit-ed srng lists (git-fixes).\n- wifi: ath11k: fix dest ring-buffer corruption (git-fixes).\n- wifi: ath11k: fix dest ring-buffer corruption when ring is full (git-fixes).\n- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (git-fixes).\n- wifi: ath11k: fix source ring-buffer corruption (git-fixes).\n- wifi: ath11k: fix suspend use-after-free after probe failure (git-fixes).\n- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (git-fixes).\n- wifi: ath12k: fix dest ring-buffer corruption (git-fixes).\n- wifi: ath12k: fix dest ring-buffer corruption when ring is full (git-fixes).\n- wifi: ath12k: fix endianness handling while accessing wmi service bit (git-fixes).\n- wifi: ath12k: fix source ring-buffer corruption (git-fixes).\n- wifi: ath6kl: remove WARN on bad firmware input (stable-fixes).\n- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (git-fixes).\n- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (git-fixes).\n- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (git-fixes).\n- wifi: cfg80211: fix S1G beacon head validation in nl80211 (git-fixes).\n- wifi: cfg80211: remove scan request n_channels counted_by (git-fixes).\n- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (git-fixes).\n- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (git-fixes).\n- wifi: iwlwifi: return ERR_PTR from opmode start() (stable-fixes).\n- wifi: mac80211: Add link iteration macro for link data (stable-fixes).\n- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (git-fixes).\n- wifi: mac80211: Create separate links for VLAN interfaces (stable-fixes).\n- wifi: mac80211: Do not call fq_flow_idx() for management frames (git-fixes).\n- wifi: mac80211: Do not schedule stopped TXQs (git-fixes).\n- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (git-fixes).\n- wifi: mac80211: chan: chandef is non-NULL for reserved (stable-fixes).\n- wifi: mac80211: drop invalid source address OCB frames (stable-fixes).\n- wifi: mac80211: finish link init before RCU publish (git-fixes).\n- wifi: mac80211: fix non-transmitted BSSID profile search (git-fixes).\n- wifi: mac80211: reject TDLS operations when station is not associated (git-fixes).\n- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (git-fixes).\n- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (git-fixes).\n- wifi: mt76: mt7925: fix the wrong config for tx interrupt (git-fixes).\n- wifi: nl80211: Set num_sub_specs before looping through sub_specs (git-fixes).\n- wifi: plfxlc: Fix error handling in usb driver probe (git-fixes).\n- wifi: prevent A-MSDU attacks in mesh networks (stable-fixes).\n- wifi: rt2x00: fix remove callback type mismatch (git-fixes).\n- wifi: rtl818x: Kill URBs before clearing tx status queue (git-fixes).\n- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (git-fixes).\n- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (git-fixes).\n- x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 (bsc#1246449).\n- x86/CPU/AMD: Improve the erratum 1386 workaround (git-fixes).\n- x86/CPU/AMD: Terminate the erratum_1386_microcode array (git-fixes).\n- x86/cpu/amd: Fix workaround for erratum 1054 (git-fixes).\n- x86/cpu: Avoid running off the end of an AMD erratum table (git-fixes).\n- x86/cpu: Expose only stepping min/max interface (git-fixes).\n- x86/cpu: Introduce new microcode matching helper (git-fixes).\n- x86/cpu: Move AMD erratum 1386 table over to 'x86_cpu_id' (git-fixes).\n- x86/cpu: Replace PEBS use of 'x86_cpu_desc' use with 'x86_cpu_id' (git-fixes).\n- x86/mce/amd: Add default names for MCA banks and blocks (git-fixes).\n- x86/mce/amd: Fix threshold limit reset (git-fixes).\n- x86/mce: Do not remove sysfs if thresholding sysfs init fails (git-fixes).\n- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (git-fixes).\n- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (git-fixes).\n- x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).\n- x86/traps: Initialize DR6 by writing its architectural reset value (git-fixes).\n- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (git-fixes).\n- x86: UV RTC: Add parameter to disable RTC clocksource (bsc#1241345).\n- xfs: fix off-by-one error in fsmap's end_daddr usage (bsc#1235837).\n- xfs: only create event xfs_file_compat_ioctl when CONFIG_COMPAT is configure (git-fixes).\n- xfs: remove unused event xfs_alloc_near_error (git-fixes).\n- xfs: remove unused event xfs_alloc_near_nominleft (git-fixes).\n- xfs: remove unused event xfs_attr_node_removename (git-fixes).\n- xfs: remove unused event xfs_ioctl_clone (git-fixes).\n- xfs: remove unused event xfs_pagecache_inval (git-fixes).\n- xfs: remove unused event xlog_iclog_want_sync (git-fixes).\n- xfs: remove unused trace event xfs_attr_remove_iter_return (git-fixes).\n- xfs: remove unused trace event xfs_attr_rmtval_set (git-fixes).\n- xfs: remove unused trace event xfs_reflink_cow_enospc (git-fixes).\n- xfs: remove unused xfs_attr events (git-fixes).\n- xfs: remove unused xfs_reflink_compare_extents events (git-fixes).\n- xfs: remove usused xfs_end_io_direct events (git-fixes).\n- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (git-fixes).\n- xhci: dbc: Flush queued requests before stopping dbc (git-fixes).\n- xhci: dbctty: disable ECHO flag by default (git-fixes).\n","status":"published","published":"2025-08-27T12:04:21Z","modified":"2026-03-23T04:48:43.338132Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03011-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2019-11135: enabled CONFIG_X86_INTEL_TSX_MODE_AUTO (bsc#1139073, bsc#1246695).\n- CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).\n- CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).\n- CVE-2024-39298:mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082).  \n- CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).\n- CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).\n- CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).\n- CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).\n- CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).\n- CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).\n- CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).\n- CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).\n- CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).\n- CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).\n- CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).\n- CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).\n- CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).\n- CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).\n- CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).\n- CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).\n- CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).\n- CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).\n- CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).\n- CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).\n- CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).\n- CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).\n- CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).\n- CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).\n- CVE-2025-38074: vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex (bsc#1244735).\n- CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).\n- CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).\n- CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).\n- CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).\n- CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).\n- CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).\n- CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).\n- CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).\n- CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).\n- CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).\n- CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).\n- CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).\n- CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).\n- CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).\n- CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).\n- CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).\n- CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).\n- CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).\n- CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).\n- CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).\n- CVE-2025-38188: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (bsc#1246098).\n- CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).\n- CVE-2025-38202: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (bsc#1245980).\n- CVE-2025-38203: jfs: Fix null-ptr-deref in jfs_ioc_trim (bsc#1246044).\n- CVE-2025-38204: jfs: fix array-index-out-of-bounds read in add_missing_indices (bsc#1245983).\n- CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).\n- CVE-2025-38210: configfs-tsm-report: Fix NULL dereference of tsm_ops (bsc#1246020).\n- CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).\n- CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).\n- CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).\n- CVE-2025-38236: af_unix: Disable MSG_OOB for unprivileged users (bsc#1246093).\n- CVE-2025-38239: scsi: megaraid_sas: Fix invalid node index (bsc#1246178).\n- CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).\n- CVE-2025-38248: bridge: mcast: Fix use-after-free during router port configuration (bsc#1246173).\n- CVE-2025-38250: kABI workaround for bluetooth hci_dev changes (bsc#1246182).\n- CVE-2025-38256: io_uring/rsrc: fix folio unpinning (bsc#1246188).\n- CVE-2025-38264: llist: add interface to check if a node is on a list (bsc#1246387).\n- CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).\n- CVE-2025-38279: selftests/bpf: Add tests with stack ptr register in conditional jmp (bsc#1246264).\n- CVE-2025-38283: hisi_acc_vfio_pci: bugfix live migration function without VF device driver (bsc#1246273).\n- CVE-2025-38303: Bluetooth: eir: Fix possible crashes on eir_create_adv_data (bsc#1246354).\n- CVE-2025-38310: seg6: Fix validation of nexthop addresses (bsc#1246361).\n- CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).\n- CVE-2025-38334: x86/sgx: Prevent attempts to reclaim poisoned pages (bsc#1246384).\n- CVE-2025-38335: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (bsc#1246250).\n- CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).\n- CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).\n- CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).\n- CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).\n- CVE-2025-38364: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (bsc#1247091).\n- CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).\n- CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).\n- CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).\n- CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).\n- CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).\n- CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).\n- CVE-2025-38403: vsock/vmci: Clear the vmci transport packet properly when initializing it (bsc#1247141).\n- CVE-2025-38414: wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (bsc#1247145).\n- CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).\n- CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written (bsc#1247253).\n- CVE-2025-38453: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234).\n- CVE-2025-38455: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (bsc#1247101).\n- CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).\n- CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).\n- CVE-2025-38461: vsock: Fix transport_* TOCTOU (bsc#1247103).\n- CVE-2025-38462: vsock: Fix transport_{g2h,h2g} TOCTOU (bsc#1247104).\n- CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).\n- CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).\n- CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).\n- CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).\n- CVE-2025-38475: smc: Fix various oops due to inet_sock type confusion (bsc#1247308).\n- CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).\n- CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).\n\nThe following non-security bugs were fixed:\n\n- ACPI: LPSS: Remove AudioDSP related ID (git-fixes).\n- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (bsc#1246122).\n- ACPI: processor: perflib: Fix initial _PPC limit application (git-fixes).\n- ACPICA: Refuse to evaluate a method if arguments are missing (stable-fixes).\n- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (git-fixes).\n- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (stable-fixes).\n- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (git-fixes).\n- ALSA: hda/tegra: Add Tegra264 support (stable-fixes).\n- ALSA: hda: Add missing NVIDIA HDA codec IDs (stable-fixes).\n- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (stable-fixes).\n- ALSA: hda: Ignore unsol events for cards being shut down (stable-fixes).\n- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (git-fixes).\n- ALSA: sb: Do not allow changing the DMA mode during operations (stable-fixes).\n- ALSA: sb: Force to disable DMAs once when DMA mode is changed (stable-fixes).\n- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (git-fixes).\n- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (stable-fixes).\n- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (stable-fixes).\n- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (stable-fixes).\n- ASoC: amd: yc: update quirk data for HP Victus (stable-fixes).\n- ASoC: codec: wcd9335: Convert to GPIO descriptors (stable-fixes).\n- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (git-fixes).\n- ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe() (stable-fixes).\n- ASoC: cs35l56: probe() should fail if the device ID is not recognized (git-fixes).\n- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (git-fixes).\n- ASoC: fsl_sai: Force a software reset when starting in consumer mode (git-fixes).\n- ASoC: fsl_xcvr: get channel status data when PHY is not exists (git-fixes).\n- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (git-fixes).\n- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (git-fixes).\n- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (git-fixes).\n- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (git-fixes).\n- Bluetooth: HCI: Set extended advertising data synchronously (git-fixes).\n- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (stable-fixes).\n- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (git-fixes).\n- Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT (git-fixes).\n- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (git-fixes).\n- Bluetooth: MGMT: set_mesh: update LE scan interval and window (git-fixes).\n- Bluetooth: Prevent unintended pause by checking if advertising is active (git-fixes).\n- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (git-fixes).\n- Bluetooth: SMP: If an unallowed command is received consider it a failure (git-fixes).\n- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (git-fixes).\n- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (git-fixes).\n- Bluetooth: hci_conn: Fix sending BT_HCI_CMD_LE_CREATE_CONN_CANCEL (git-fixes).\n- Bluetooth: hci_core: add missing braces when using macro parameters (git-fixes).\n- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (git-fixes).\n- Bluetooth: hci_event: Mask data status from LE ext adv reports (git-fixes).\n- Bluetooth: hci_sync: Attempt to dequeue connection attempt (git-fixes).\n- Bluetooth: hci_sync: Fix UAF on create_le_conn_complete (git-fixes).\n- Bluetooth: hci_sync: Fix handling of HCI_OP_CREATE_CONN_CANCEL (git-fixes).\n- Bluetooth: hci_sync: Fix not disabling advertising instance (git-fixes).\n- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (git-fixes).\n- Bluetooth: hci_sync: revert some mesh modifications (git-fixes).\n- Docs/ABI: Fix sysfs-kernel-address_bits path (git-fixes).\n- Documentatiion/ABI: add ABI documentation for sys-bus-dax (bsc#1235515,jsc#PED-12731).\n- Documentation: ACPI: Fix parent device references (git-fixes).\n- Documentation: usb: gadget: Wrap remaining usage snippets in literal code block (git-fixes).\n- Enable SMC_LO (a.k.a SMC-D) (jsc#PED-13248).\n- Fix dma_unmap_sg() nents value (git-fixes)\n- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (stable-fixes).\n- HID: core: do not bypass hid_hw_raw_request (stable-fixes).\n- HID: core: ensure __hid_request reserves the report ID as the first byte (git-fixes).\n- HID: core: ensure the allocated report buffer can contain the reserved report ID (stable-fixes).\n- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (stable-fixes).\n- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (stable-fixes).\n- IB/mlx5: Fix potential deadlock in MR deregistration (git-fixes)\n- Input: iqs7222 - explicitly define number of external channels (git-fixes).\n- Input: xpad - adjust error handling for disconnect (git-fixes).\n- Input: xpad - set correct controller type for Acer NGR200 (git-fixes).\n- Input: xpad - support Acer NGR 200 Controller (stable-fixes).\n- KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).\n- Logitech C-270 even more broken (stable-fixes).\n- Move upstreamed SCSI and ACPI patches into sorted section\n- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (git-fixes).\n- NFS: Fix the setting of capabilities when automounting a new filesystem (git-fixes).\n- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (git-fixes).\n- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (git-fixes).\n- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (git-fixes).\n- NFSv4.2: another fix for listxattr (git-fixes).\n- NFSv4.2: fix listxattr to return selinux security label (git-fixes).\n- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (git-fixes).\n- NFSv4: Always set NLINK even if the server does not support it (git-fixes).\n- NFSv4: xattr handlers should check for absent nfs filehandles (git-fixes).\n- PCI/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X allocations (bsc#1245457).\n- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (stable-fixes).\n- PCI: endpoint: Fix configfs group list head handling (git-fixes).\n- PCI: endpoint: Fix configfs group removal on driver teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (git-fixes).\n- PCI: hv: Allow dynamic MSI-X vector allocation (bsc#1245457).\n- PCI: rockchip-host: Fix 'Unexpected Completion' log message (git-fixes).\n- PM / devfreq: Check governor before using governor-\u003ename (git-fixes).\n- RDMA/core: Rate limit GID cache warning messages (git-fixes)\n- RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes)\n- RDMA/hns: Drop GFP_NOWARN (git-fixes)\n- RDMA/hns: Fix -Wframe-larger-than issue (git-fixes)\n- RDMA/hns: Fix HW configurations not cleared in error flow (git-fixes)\n- RDMA/hns: Fix accessing uninitialized resources (git-fixes)\n- RDMA/hns: Fix double destruction of rsv_qp (git-fixes)\n- RDMA/hns: Get message length of ack_req from FW (git-fixes)\n- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes)\n- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes)\n- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes)\n- RDMA/mlx5: Fix CC counters query for MPV (git-fixes)\n- RDMA/mlx5: Fix HW counters query for non-representor devices (git-fixes)\n- RDMA/mlx5: Fix UMR modifying of mkey page size (git-fixes)\n- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes)\n- RDMA/mlx5: Fix vport loopback for MPV device (git-fixes)\n- RDMA/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert (git-fixes)\n- RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup (git-fixes)\n- RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes)\n- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (git-fixes)\n- RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes)\n- RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes)\n- RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes)\n- RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes)\n- Re-enable qmi_wwan for arm64 (bsc#1246113)\n- Reapply 'wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()' (git-fixes).\n- Revert 'ACPI: battery: negate current when discharging' (stable-fixes).\n- Revert 'cgroup_freezer: cgroup_freezing: Check if not frozen' (bsc#1219338).\n- Revert 'drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1' (stable-fixes).\n- Revert 'drm/nouveau: check ioctl command codes better' (git-fixes).\n- Revert 'drm/xe/xe2: Enable Indirect Ring State support for Xe2' (git-fixes).\n- Revert 'mmc: sdhci: Disable SD card clock before changing parameters' (git-fixes).\n- Revert 'usb: xhci: Implement xhci_handshake_check_state() helper' (git-fixes).\n- Revert 'vgacon: Add check for vc_origin address range in vgacon_scroll()' (stable-fixes).\n- SMB3: rename macro CIFS_SERVER_IS_CHAN to avoid confusion (git-fixes).\n- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (stable-fixes).\n- USB: serial: option: add Foxconn T99W640 (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (stable-fixes).\n- Update config files. config/x86_64/default config/arm64/default CONFIG_INTEGRITY_MACHINE_KEYRING=y +CONFIG_INTEGRITY_CA_MACHINE_KEYRING=y +CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y +CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y (bsc#1243678)\n- [SMB3] send channel sequence number in SMB3 requests after reconnects (git-fixes).\n- accel/ivpu: Remove copy engine support (stable-fixes).\n- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (git-fixes).\n- af_unix: Add a prompt to CONFIG_AF_UNIX_OOB (bsc#1246093).\n- amd/amdkfd: fix a kfd_process ref leak (stable-fixes).\n- aoe: clean device rq_list in aoedev_downdev() (git-fixes).\n- apple-mfi-fastcharge: protect first device name (git-fixes).\n- ata: pata_cs5536: fix build on 32-bit UML (stable-fixes).\n- audit,module: restore audit logging in load failure case (git-fixes).\n- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (git-fixes).\n- bonding: Correctly support GSO ESP offload (git-fixes).\n- bpf, sockmap: Fix sk_msg_reset_curr (git-fixes).\n- bpf/lpm_trie: Inline longest_prefix_match for fastpath (git-fixes).\n- bpf/selftests: Check errno when percpu map value size exceeds (git-fixes).\n- bpf: Add a possibly-zero-sized read test (git-fixes).\n- bpf: Avoid __hidden__ attribute in static object (git-fixes).\n- bpf: Check percpu map value size first (git-fixes).\n- bpf: Disable some `attribute ignored' warnings in GCC (git-fixes).\n- bpf: Fix memory leak in bpf_core_apply (git-fixes).\n- bpf: Fix potential integer overflow in resolve_btfids (git-fixes).\n- bpf: Harden __bpf_kfunc tag against linker kfunc removal (git-fixes).\n- bpf: Make the pointer returned by iter next method valid (git-fixes).\n- bpf: Simplify checking size of helper accesses (git-fixes).\n- bpf: fix order of args in call to bpf_map_kvcalloc (git-fixes).\n- bpf: sockmap, updating the sg structure should also update curr (git-fixes).\n- bpftool: Fix missing pids during link show (git-fixes).\n- bpftool: Fix undefined behavior caused by shifting into the sign bit (git-fixes).\n- bpftool: Mount bpffs on provided dir instead of parent dir (git-fixes).\n- bpftool: Remove unnecessary source files from bootstrap version (git-fixes).\n- bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer (git-fixes).\n- btrfs: do not ignore inode missing when replaying log tree (git-fixes).\n- btrfs: do not silently ignore unexpected extent type when replaying log (git-fixes).\n- btrfs: do not skip remaining extrefs if dir not found during log replay (git-fixes).\n- btrfs: explicitly ref count block_group on new_bgs list (bsc#1243068)\n- btrfs: fix assertion when building free space tree (git-fixes).\n- btrfs: fix inode lookup error handling during log replay (git-fixes).\n- btrfs: fix invalid inode pointer dereferences during log replay (git-fixes).\n- btrfs: fix log tree replay failure due to file with 0 links and extents (git-fixes).\n- btrfs: fix missing error handling when searching for inode refs during log replay (git-fixes).\n- btrfs: fix non-empty delayed iputs list on unmount due to async workers (git-fixes).\n- btrfs: fix ssd_spread overallocation (git-fixes).\n- btrfs: make btrfs_discard_workfn() block_group ref explicit (bsc#1243068)\n- btrfs: propagate last_unlink_trans earlier when doing a rmdir (git-fixes).\n- btrfs: rename err to ret in btrfs_rmdir() (git-fixes).\n- btrfs: return a btrfs_inode from btrfs_iget_logging() (git-fixes).\n- btrfs: return a btrfs_inode from read_one_inode() (git-fixes).\n- btrfs: tests: fix chunk map leak after failure to add it to the tree (git-fixes).\n- btrfs: update superblock's device bytes_used when dropping chunk (git-fixes).\n- btrfs: use NOFS context when getting inodes during logging and log replay (git-fixes).\n- btrfs: use btrfs_record_snapshot_destroy() during rmdir (git-fixes).\n- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (git-fixes).\n- bus: mhi: host: Detect events pointing to unexpected TREs (git-fixes).\n- can: dev: can_restart(): move debug message and stats after successful restart (stable-fixes).\n- can: dev: can_restart(): reverse logic to remove need for goto (stable-fixes).\n- can: kvaser_pciefd: Store device channel index (git-fixes).\n- can: kvaser_usb: Assign netdev.dev_port based on device channel index (git-fixes).\n- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (git-fixes).\n- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (git-fixes).\n- can: peak_usb: fix USB FD devices potential malfunction (git-fixes).\n- cdc-acm: fix race between initial clearing halt and open (git-fixes).\n- cgroup,freezer: fix incomplete freezing when attaching tasks (bsc#1245789).\n- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (bsc#1241166).\n- cifs: reconnect helper should set reconnect for the right channel (git-fixes).\n- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (git-fixes).\n- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (git-fixes).\n- clk: sunxi-ng: v3s: Fix de clock definition (git-fixes).\n- clk: xilinx: vcu: unregister pll_post only if registered correctly (git-fixes).\n- clocksource: Scale the watchdog read retries automatically (bsc#1241345 bsc#1244457).\n- clocksource: Set cs_watchdog_read() checks based on .uncertainty_margin (bsc#1241345 bsc#1244457).\n- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (git-fixes).\n- comedi: Fix initialization of data for instructions that write to subdevice (git-fixes).\n- comedi: Fix some signed shift left operations (git-fixes).\n- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (git-fixes).\n- comedi: aio_iiro_16: Fix bit shift out of bounds (git-fixes).\n- comedi: das16m1: Fix bit shift out of bounds (git-fixes).\n- comedi: das6402: Fix bit shift out of bounds (git-fixes).\n- comedi: pcl812: Fix bit shift out of bounds (git-fixes).\n- compiler_types.h: Define __retain for __attribute__((__retain__)) (git-fixes).\n- crypto: arm/aes-neonbs - work around gcc-15 warning (git-fixes).\n- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (git-fixes).\n- crypto: ccp - Fix locking on alloc failure handling (git-fixes).\n- crypto: hkdf - skip TVs with unapproved salt lengths in FIPS mode (bsc#1241200 bsc#1246134).\n- crypto: img-hash - Fix dma_unmap_sg() nents value (git-fixes).\n- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (git-fixes).\n- crypto: keembay - Fix dma_unmap_sg() nents value (git-fixes).\n- crypto: marvell/cesa - Fix engine load inaccuracy (git-fixes).\n- crypto: qat - allow enabling VFs in the absence of IOMMU (git-fixes).\n- crypto: qat - disable ZUC-256 capability for QAT GEN5 (git-fixes).\n- crypto: qat - fix DMA direction for compression on GEN2 devices (git-fixes).\n- crypto: qat - fix seq_file position update in adf_ring_next() (git-fixes).\n- crypto: qat - fix state restore for banks with exceptions (git-fixes).\n- crypto: qat - flush misc workqueue during device shutdown (git-fixes).\n- crypto: qat - use unmanaged allocation for dc_data (git-fixes).\n- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (git-fixes).\n- dax: add a sysfs knob to control memmap_on_memory behavior (bsc#1235515,jsc#PED-12731).\n- devlink: Add support for u64 parameters (jsc#PED-12745).\n- devlink: avoid param type value translations (jsc#PED-12745).\n- devlink: define enum for attr types of dynamic attributes (jsc#PED-12745).\n- devlink: introduce devlink_nl_put_u64() (jsc#PED-12745).\n- disable ZL3073X\n- dm-bufio: fix sched in atomic context (git-fixes).\n- dm-flakey: error all IOs when num_features is absent (git-fixes).\n- dm-flakey: make corrupting read bios work (git-fixes).\n- dm-mirror: fix a tiny race condition (git-fixes).\n- dm-raid: fix variable in journal device check (git-fixes).\n- dm-verity: fix a memory leak if some arguments are specified multiple times (git-fixes).\n- dm: do not change md if dm_table_set_restrictions() fails (git-fixes).\n- dm: free table mempools if not used in __bind (git-fixes).\n- dm: restrict dm device size to 2^63-512 bytes (git-fixes).\n- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (stable-fixes).\n- dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() (git-fixes).\n- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (stable-fixes).\n- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (git-fixes).\n- dmaengine: nbpfaxi: Add missing check after DMA map (git-fixes).\n- dmaengine: nbpfaxi: Fix memory corruption in probe() (git-fixes).\n- dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() (git-fixes).\n- dmaengine: xilinx_dma: Set dma_device directions (stable-fixes).\n- dpll: Add basic Microchip ZL3073x support (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set frequency on pins (jsc#PED-12745).\n- dpll: zl3073x: Add support to get/set priority on input pins (jsc#PED-12745).\n- dpll: zl3073x: Fetch invariants during probe (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin selection in manual mode (jsc#PED-12745).\n- dpll: zl3073x: Implement input pin state setting in automatic mode (jsc#PED-12745).\n- dpll: zl3073x: Read DPLL types and pin properties from system firmware (jsc#PED-12745).\n- dpll: zl3073x: Register DPLL devices and pins (jsc#PED-12745).\n- drm/amd/display: Check dce_hwseq before dereferencing it (stable-fixes).\n- drm/amd/display: Correct non-OLED pre_T11_delay (stable-fixes).\n- drm/amd/display: Disable CRTC degamma LUT for DCN401 (stable-fixes).\n- drm/amd/display: Do not overwrite dce60_clk_mgr (git-fixes).\n- drm/amd/display: Fix RMCM programming seq errors (stable-fixes).\n- drm/amd/display: Fix mpv playback corruption on weston (stable-fixes).\n- drm/amd/display: Free memory allocation (stable-fixes).\n- drm/amd/display: fix initial backlight brightness calculation (git-fixes).\n- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (git-fixes).\n- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (stable-fixes).\n- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (git-fixes).\n- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (git-fixes).\n- drm/amdgpu/ip_discovery: add missing ip_discovery fw (stable-fixes).\n- drm/amdgpu: Add kicker device detection (stable-fixes).\n- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (stable-fixes).\n- drm/amdgpu: Increase reset counter only on success (stable-fixes).\n- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (git-fixes).\n- drm/amdgpu: Remove nbiov7.9 replay count reporting (git-fixes).\n- drm/amdgpu: Reset the clear flag in buddy during resume (git-fixes).\n- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (stable-fixes).\n- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (stable-fixes).\n- drm/amdkfd: Do not call mmput from MMU notifier callback (git-fixes).\n- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (stable-fixes).\n- drm/amdkfd: Fix race in GWS queue scheduling (stable-fixes).\n- drm/amdkfd: remove gfx 12 trap handler page size cap (stable-fixes).\n- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (git-fixes).\n- drm/bridge: panel: move prepare_prev_first handling to drm_panel_bridge_add_typed (git-fixes).\n- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (git-fixes).\n- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (git-fixes).\n- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (stable-fixes).\n- drm/connector: hdmi: Evaluate limited range after computing format (git-fixes).\n- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (git-fixes).\n- drm/exynos: fimd: Guard display clock control with runtime PM calls (git-fixes).\n- drm/framebuffer: Acquire internal references on GEM handles (git-fixes).\n- drm/gem: Acquire references on GEM handles for framebuffers (stable-fixes).\n- drm/gem: Fix race in drm_gem_handle_create_tail() (stable-fixes).\n- drm/i915/display: Fix dma_fence_wait_timeout() return value handling (git-fixes).\n- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (stable-fixes).\n- drm/i915/gsc: mei interrupt top half should be in irq disabled context (git-fixes).\n- drm/i915/gt: Fix timeline left held on VMA alloc error (git-fixes).\n- drm/i915/selftests: Change mock_request() to return error pointers (git-fixes).\n- drm/imagination: Fix kernel crash when hard resetting the GPU (git-fixes).\n- drm/mediatek: Add wait_event_timeout when disabling plane (git-fixes).\n- drm/mediatek: only announce AFBC if really supported (git-fixes).\n- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (git-fixes).\n- drm/msm: Fix a fence leak in submit error path (stable-fixes).\n- drm/msm: Fix another leak in the submit error path (stable-fixes).\n- drm/nouveau: check ioctl command codes better (git-fixes).\n- drm/panfrost: Fix panfrost device variable name in devfreq (git-fixes).\n- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (git-fixes).\n- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (git-fixes).\n- drm/sched: Increment job count before swapping tail spsc queue (git-fixes).\n- drm/sched: Remove optimization that causes hang when killing dependent jobs (git-fixes).\n- drm/scheduler: signal scheduled fence when kill job (stable-fixes).\n- drm/tegra: nvdec: Fix dma_alloc_coherent error check (git-fixes).\n- drm/ttm: fix error handling in ttm_buffer_object_transfer (git-fixes).\n- drm/v3d: Disable interrupts before resetting the GPU (git-fixes).\n- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (git-fixes).\n- drm/xe/bmg: fix compressed VRAM handling (git-fixes).\n- drm/xe/guc: Dead CT helper (stable-fixes).\n- drm/xe/guc: Explicitly exit CT safe mode on unwind (git-fixes).\n- drm/xe/guc_submit: add back fix (git-fixes).\n- drm/xe/mocs: Initialize MOCS index early (stable-fixes).\n- drm/xe/pf: Clear all LMTT pages on alloc (git-fixes).\n- drm/xe/pf: Move VFs reprovisioning to worker (stable-fixes).\n- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (git-fixes).\n- drm/xe/pf: Sanitize VF scratch registers on FLR (stable-fixes).\n- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (git-fixes).\n- drm/xe/uapi: Correct sync type definition in comments (git-fixes).\n- drm/xe/vf: Disable CSC support on VF (git-fixes).\n- drm/xe: Allocate PF queue size on pow2 boundary (git-fixes).\n- drm/xe: Allow bo mapping on multiple ggtts (stable-fixes).\n- drm/xe: Fix DSB buffer coherency (stable-fixes).\n- drm/xe: Fix build without debugfs (git-fixes).\n- drm/xe: Fix early wedge on GuC load failure (git-fixes).\n- drm/xe: Fix taking invalid lock on wedge (stable-fixes).\n- drm/xe: Move DSB l2 flush to a more sensible place (git-fixes).\n- drm/xe: Replace double space with single space after comma (stable-fixes).\n- drm/xe: add interface to request physical alignment for buffer objects (stable-fixes).\n- drm/xe: move DPT l2 flush to a more sensible place (git-fixes).\n- dt-bindings: dpll: Add DPLL device and pin (jsc#PED-12745).\n- dt-bindings: dpll: Add support for Microchip Azurite chip family (jsc#PED-12745).\n- e1000: Move cancel_work_sync to avoid deadlock (git-fixes).\n- exfat: fdatasync flag should be same like generic_write_sync() (git-fixes).\n- fbcon: Fix outdated registered_fb reference in comment (git-fixes).\n- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (git-fixes).\n- firewire: ohci: correct code comments about bus_reset tasklet (git-fixes).\n- fs/jfs: consolidate sanity checking in dbMount (git-fixes).\n- fs/orangefs: Allow 2 more characters in do_c_string() (git-fixes).\n- gpio: mlxbf2: use platform_get_irq_optional() (git-fixes).\n- gpio: pca953x: log an error when failing to get the reset GPIO (git-fixes).\n- gpio: sim: include a missing header (git-fixes).\n- gpio: vf610: add locking to gpio direction functions (git-fixes).\n- gpio: virtio: Fix config space reading (git-fixes).\n- gpiolib: Fix debug messaging in gpiod_find_and_request() (git-fixes).\n- gpiolib: Handle no pin_ranges in gpiochip_generic_config() (git-fixes).\n- gpiolib: acpi: Do not use GPIO chip fwnode in acpi_gpiochip_find() (bsc#1233300).\n- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match (bsc#1233300).\n- gpiolib: cdev: Ignore reconfiguration without direction (git-fixes).\n- gpiolib: of: Add polarity quirk for s5m8767 (stable-fixes).\n- hfs: make splice write available again (git-fixes).\n- hfsplus: make splice write available again (git-fixes).\n- hfsplus: remove mutex_lock check in hfsplus_free_extents (git-fixes).\n- hv_netvsc: Use VF's tso_max_size value when data path is VF (bsc#1246203).\n- hwmon: (corsair-cpro) Validate the size of the received input buffer (git-fixes).\n- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (git-fixes).\n- hwmon: (pmbus/max34440) Fix support for max34451 (stable-fixes).\n- hwrng: mtk - handle devm_pm_runtime_enable errors (git-fixes).\n- i2c/designware: Fix an initialization issue (git-fixes).\n- i2c: qup: jump out of the loop in case of timeout (git-fixes).\n- i2c: stm32: fix the device used for the DMA map (git-fixes).\n- i2c: tegra: Fix reset error handling with ACPI (git-fixes).\n- i2c: virtio: Avoid hang by using interruptible completion wait (git-fixes).\n- i3c: fix module_i3c_i2c_driver() with I3C=n (git-fixes).\n- ice, irdma: fix an off by one in error handling code (bsc#1247712).\n- ice, irdma: move interrupts code to irdma (bsc#1247712).\n- ice: Fix signedness bug in ice_init_interrupt_scheme() (bsc#1247712).\n- ice: count combined queues using Rx/Tx count (bsc#1247712).\n- ice: devlink PF MSI-X max and min parameter (bsc#1247712).\n- ice: enable_rdma devlink param (bsc#1247712).\n- ice: fix eswitch code memory leak in reset scenario (git-fixes).\n- ice: get rid of num_lan_msix field (bsc#1247712).\n- ice: init flow director before RDMA (bsc#1247712).\n- ice: remove splitting MSI-X between features (bsc#1247712).\n- ice: simplify VF MSI-X managing (bsc#1247712).\n- ice: treat dyn_allowed only as suggestion (bsc#1247712).\n- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (git-fixes).\n- iio: adc: ad7949: use spi_is_bpw_supported() (git-fixes).\n- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (stable-fixes).\n- iio: adc: ad_sigma_delta: change to buffer predisable (git-fixes).\n- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (stable-fixes).\n- iio: adc: max1363: Reorder mode_list[] entries (stable-fixes).\n- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (git-fixes).\n- iio: imu: bno055: fix OOB access of hw_xlate array (git-fixes).\n- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (stable-fixes).\n- io_uring/timeout: fix multishot updates (bsc#1247021).\n- io_uring: fix potential page leak in io_sqe_buffer_register() (git-fixes).\n- iommu/amd: Fix geometry.aperture_end for V2 tables (git-fixes).\n- iommu/amd: Set the pgsize_bitmap correctly (git-fixes).\n- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (git-fixes).\n- iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding (git-fixes).\n- iommu/vt-d: Fix possible circular locking dependency (git-fixes).\n- iommu/vt-d: Fix system hang on reboot -f (git-fixes).\n- ipv6: fix possible infinite loop in fib6_info_uses_dev() (git-fixes).\n- ipv6: mcast: Delay put pmc-\u003eidev in mld_del_delrec() (git-fixes).\n- ipv6: prevent infinite loop in rt6_nlmsg_size() (git-fixes).\n- ipv6: reject malicious packets in ipv6_gso_segment() (git-fixes).\n- irdma: free iwdev-\u003erf after removing MSI-X (bsc#1247712).\n- iwlwifi: Add missing check for alloc_ordered_workqueue (git-fixes).\n- jfs: fix metapage reference count leak in dbAllocCtl (git-fixes).\n- kABI fix after KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).\n- kABI fixes for struct memory_block changes (bsc#1235515,jsc#PED-12731).\n- kABI workaround for fw_attributes_class_get() (stable-fixes).\n- kABI workaround for struct drm_framebuffer changes (git-fixes).\n- kABI: Fix the module::name type in audit_context (git-fixes).\n- kabi/severities: ignore two unused/dropped symbols from MEI\n- kabi: Hide adding of u64 to devlink_param_type (jsc#PED-12745).\n- kasan: remove kasan_find_vm_area() to prevent possible deadlock (git-fixes).\n- kernel-obs-qa: Do not depend on srchash when qemu emulation is used In this case the dependency is never fulfilled\n- kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).\n- leds: multicolor: Fix intensity setting while SW blinking (stable-fixes).\n- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (bsc#1236897).\n- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (bsc#1236897).\n- maple_tree: fix mt_destroy_walk() on root leaf node (git-fixes).\n- md/md-bitmap: fix dm-raid max_write_behind setting (git-fixes).\n- media: gspca: Add bounds checking to firmware parser (git-fixes).\n- media: hi556: correct the test pattern configuration (git-fixes).\n- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (git-fixes).\n- media: ipu6: isys: Use correct pads for xlate_streams() (git-fixes).\n- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (git-fixes).\n- media: ov2659: Fix memory leaks in ov2659_probe() (git-fixes).\n- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (git-fixes).\n- media: usbtv: Lock resolution while streaming (git-fixes).\n- media: uvcvideo: Do not mark valid metadata as invalid (git-fixes).\n- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (git-fixes).\n- media: v4l2-ctrls: Do not reset handler's error in v4l2_ctrl_handler_free() (git-fixes).\n- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (git-fixes).\n- media: venus: Add a check for packet size after reading from shared memory (git-fixes).\n- media: venus: hfi: explicitly release IRQ during teardown (git-fixes).\n- media: venus: protect against spurious interrupts during probe (git-fixes).\n- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240 (git-fixes).\n- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (git-fixes).\n- media: verisilicon: Fix AV1 decoder clock frequency (git-fixes).\n- media: vivid: fix wrong pixel_array control size (git-fixes).\n- mei: vsc: Destroy mutex after freeing the IRQ (git-fixes).\n- mei: vsc: Do not re-init VSC from mei_vsc_hw_reset() on stop (git-fixes).\n- mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq() (stable-fixes).\n- mei: vsc: Event notifier fixes (git-fixes).\n- mei: vsc: Fix 'BUG: Invalid wait context' lockdep error (git-fixes).\n- mei: vsc: Run event callback from a workqueue (git-fixes).\n- mei: vsc: Unset the event callback on remove and probe errors (git-fixes).\n- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (git-fixes).\n- mfd: max14577: Fix wakeup source leaks on device unbind (stable-fixes).\n- misc: rtsx: usb: Ensure mmc child device is active when card is present (git-fixes).\n- mm/memory_hotplug: allow architecture to override memmap on memory support check (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: allow memmap on memory hotplug request to fallback (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: embed vmem_altmap details in memory block (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: export mhp_supports_memmap_on_memory() (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval (git-fixes).\n- mm/memory_hotplug: replace an open-coded kmemdup() in (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: simplify ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE kconfig (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: split memmap_on_memory requests across memblocks (bsc#1235515,jsc#PED-12731).\n- mm/memory_hotplug: support memmap_on_memory when memmap is not aligned to pageblocks (bsc#1235515,jsc#PED-12731).\n- mmc: bcm2835: Fix dma_unmap_sg() nents value (git-fixes).\n- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (git-fixes).\n- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (git-fixes).\n- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (stable-fixes).\n- mmc: sdhci_am654: Workaround for Errata i2312 (git-fixes).\n- module: Fix memory deallocation on error path in move_module() (git-fixes).\n- module: Remove unnecessary +1 from last_unloaded_module::name size (git-fixes).\n- module: Restore the moduleparam prefix length check (git-fixes).\n- mtd: fix possible integer overflow in erase_xfer() (git-fixes).\n- mtd: rawnand: atmel: Fix dma_mapping_error() address (git-fixes).\n- mtd: rawnand: atmel: set pmecc data setup time (git-fixes).\n- mtd: rawnand: fsmc: Add missing check after DMA map (git-fixes).\n- mtd: rawnand: renesas: Add missing check after DMA map (git-fixes).\n- mtd: rawnand: rockchip: Add missing check after DMA map (git-fixes).\n- mtd: spi-nor: Fix spi_nor_try_unlock_all() (git-fixes).\n- mtd: spinand: fix memory leak of ECC engine conf (stable-fixes).\n- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (git-fixes).\n- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (git-fixes).\n- mtk-sd: Prevent memory corruption from DMA map failure (git-fixes).\n- mtk-sd: reset host-\u003emrq on prepare_data() error (git-fixes).\n- mwl8k: Add missing check after DMA map (git-fixes).\n- nbd: fix uaf in nbd_genl_connect() error path (git-fixes).\n- net/mlx5: HWS, fix missing ip_version handling in definer (git-fixes).\n- net/packet: fix a race in packet_set_ring() and packet_notifier() (git-fixes).\n- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (git-fixes).\n- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (git-fixes).\n- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (git-fixes).\n- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (git-fixes).\n- net/sched: sch_qfq: Fix race condition on qfq_aggregate (git-fixes).\n- net/sched: taprio: enforce minimum value for picos_per_byte (git-fixes).\n- net/smc: Fix lookup of netdev by using ib_device_get_netdev() (git-fixes bsc#1246217).\n- net: mana: Add debug logs in MANA network driver (bsc#1246212).\n- net: mana: Add handler for hardware servicing events (bsc#1245730).\n- net: mana: Allocate MSI-X vectors dynamically (bsc#1245457).\n- net: mana: Allow irq_setup() to skip cpus for affinity (bsc#1245457).\n- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (bsc#1246203).\n- net: mana: Expose additional hardware counters for drop and TC via ethtool (bsc#1245729).\n- net: mana: Set tx_packets to post gso processing packet count (bsc#1245731).\n- net: mana: explain irq_setup() algorithm (bsc#1245457).\n- net: phy: Do not register LEDs for genphy (git-fixes).\n- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (git-fixes).\n- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (git-fixes).\n- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (git-fixes).\n- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (git-fixes).\n- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (git-fixes).\n- net: usb: qmi_wwan: add SIMCom 8230C composition (stable-fixes).\n- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (git-fixes).\n- net: usbnet: Fix the wrong netif_carrier_on() call (git-fixes).\n- netlink: fix policy dump for int with validation callback (jsc#PED-12745).\n- netlink: specs: devlink: replace underscores with dashes in names (jsc#PED-12745).\n- netlink: specs: nfsd: replace underscores with dashes in names (git-fixes).\n- netlink: specs: tc: replace underscores with dashes in names (git-fixes).\n- netpoll: prevent hanging NAPI when netcons gets enabled (git-fixes).\n- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (git-fixes).\n- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (git-fixes).\n- nilfs2: reject invalid file types when reading inodes (git-fixes).\n- nvme-pci: refresh visible attrs after being checked (git-fixes).\n- nvme: Fix incorrect cdw15 value in passthru error logging (git-fixes).\n- nvme: fix endianness of command word prints in nvme_log_err_passthru() (git-fixes).\n- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (git-fixes).\n- nvme: fix misaccounting of nvme-mpath inflight I/O (git-fixes).\n- nvmet-tcp: fix callback lock for TLS handshake (git-fixes).\n- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (git-fixes).\n- objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks (git-fixes).\n- objtool: Fix _THIS_IP_ detection for cold functions (git-fixes).\n- objtool: Fix error handling inconsistencies in check() (git-fixes).\n- objtool: Ignore dangling jump table entries (git-fixes).\n- objtool: Ignore end-of-section jumps for KCOV/GCOV (git-fixes).\n- objtool: Properly disable uaccess validation (git-fixes).\n- objtool: Silence more KCOV warnings (git-fixes).\n- objtool: Silence more KCOV warnings, part 2 (git-fixes).\n- objtool: Stop UNRET validation on UD2 (git-fixes).\n- pNFS/flexfiles: do not attempt pnfs on fatal DS errors (git-fixes).\n- pch_uart: Fix dma_sync_sg_for_device() nents value (git-fixes).\n- perf: Fix sample vs do_exit() (bsc#1246547).\n- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (git-fixes).\n- pinctrl: amd: Clear GPIO debounce for suspend (git-fixes).\n- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (git-fixes).\n- pinctrl: sunxi: Fix memory leak on krealloc failure (git-fixes).\n- pinmux: fix race causing mux_owner NULL with active mux_usecount (git-fixes).\n- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (git-fixes).\n- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (git-fixes).\n- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (git-fixes).\n- platform/mellanox: mlxreg-lc: Fix logic error in power state check (git-fixes).\n- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (git-fixes).\n- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (stable-fixes).\n- platform/x86: Fix initialization order for firmware_attributes_class (git-fixes).\n- platform/x86: dell-sysman: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix class device unregistration (git-fixes).\n- platform/x86: firmware_attributes_class: Move include linux/device/class.h (stable-fixes).\n- platform/x86: firmware_attributes_class: Simplify API (stable-fixes).\n- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: hp-bioscfg: Fix class device unregistration (git-fixes).\n- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (git-fixes).\n- platform/x86: make fw_attr_class constant (stable-fixes).\n- platform/x86: think-lmi: Create ksets consecutively (stable-fixes).\n- platform/x86: think-lmi: Directly use firmware_attributes_class (stable-fixes).\n- platform/x86: think-lmi: Fix class device unregistration (git-fixes).\n- platform/x86: think-lmi: Fix kobject cleanup (git-fixes).\n- platform/x86: think-lmi: Fix sysfs group cleanup (git-fixes).\n- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (git-fixes).\n- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (git-fixes).\n- powercap: call put_device() on an error path in powercap_register_control_type() (stable-fixes).\n- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (git-fixes).\n- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (git-fixes).\n- powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH (git-fixes).\n- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (bsc#1243042 ltc#212167).\n- ptp: fix breakage after ptp_vclock_in_use() rework (bsc#1246506).\n- pwm: imx-tpm: Reset counter if CMOD is 0 (git-fixes).\n- pwm: mediatek: Ensure to disable clocks in error path (git-fixes).\n- pwm: rockchip: Round period/duty down on apply, up on get (git-fixes).\n- regmap: fix potential memory leak of regmap_bus (git-fixes).\n- regulator: core: fix NULL dereference on unbind due to stale coupling data (stable-fixes).\n- regulator: fan53555: add enable_time support and soft-start times (stable-fixes).\n- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (git-fixes).\n- regulator: pwm-regulator: Calculate the output voltage for disabled PWMs (stable-fixes).\n- resource: fix false warning in __request_region() (git-fixes).\n- restore UCSI_CONNECTOR_RESET_HARD definition (git-fixes).\n- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() (git-fixes).\n- rose: fix dangling neighbour pointers in rose_rt_device_down() (git-fixes).\n- rpl: Fix use-after-free in rpl_do_srh_inline() (git-fixes).\n- rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879) Put the same workaround to avoid file truncation of vmlinux and co in kernel-default-base package, too.\n- rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)\n- rtc: ds1307: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: hym8563: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: nct3018y: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: pcf85063: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: pcf8563: fix incorrect maximum clock rate handling (git-fixes).\n- rtc: rv3028: fix incorrect maximum clock rate handling (git-fixes).\n- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (git-fixes bsc#1246870).\n- s390/entry: Fix last breaking event handling in case of stack corruption (git-fixes bsc#1243806).\n- s390/pci: Do not try re-enabling load/store if device is disabled (git-fixes bsc#1245646).\n- s390/pci: Fix stale function handles in error handling (git-fixes bsc#1245647).\n- s390/pkey: Prevent overflow in size calculation for memdup_user() (git-fixes bsc#1245598).\n- s390: Add z17 elf platform (LTC#214086 bsc#1245540).\n- samples: mei: Fix building on musl libc (git-fixes).\n- sched,freezer: Remove unnecessary warning in __thaw_task (bsc#1219338).\n- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (git-fixes).\n- scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask is set (git-fixes).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1246644).\n- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (git-fixes).\n- scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (git-fixes).\n- scsi: fnic: Set appropriate logging level for log message (bsc#1246644).\n- scsi: fnic: Turn off FDMI ACTIVE flags on link down (git-fixes).\n- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Copyright updates for 14.4.0.10 patches (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Modify end-of-life adapters' model descriptions (bsc#1245260 bsc#1243100 bsc#1246125 bsc#1204142).\n- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Revise logging format for failed CT MIB requests (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Update debugfs trace ring initialization messages (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: lpfc: Update lpfc version to 14.4.0.10 (bsc#1245260 bsc#1243100 bsc#1246125).\n- scsi: megaraid_sas: Fix invalid node index (git-fixes).\n- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (git-fixes).\n- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (git-fixes).\n- scsi: s390: zfcp: Ensure synchronous unit_add (git-fixes bsc#1245599).\n- selftests/bpf: Add CFLAGS per source file and runner (git-fixes).\n- selftests/bpf: Add tests for iter next method returning valid pointer (git-fixes).\n- selftests/bpf: Change functions definitions to support GCC (git-fixes).\n- selftests/bpf: Fix a few tests for GCC related warnings (git-fixes).\n- selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect (git-fixes).\n- selftests/bpf: Fix prog numbers in test_sockmap (git-fixes).\n- smb3: move server check earlier when setting channel sequence number (git-fixes).\n- smb: client: fix parsing of device numbers (git-fixes).\n- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (git-fixes).\n- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (git-fixes).\n- soc: aspeed: lpc-snoop: Do not disable channels that are not enabled (git-fixes).\n- soc: qcom: QMI encoding/decoding for big endian (git-fixes).\n- soc: qcom: fix endianness for QMI header (git-fixes).\n- soc: qcom: pmic_glink: fix OF node leak (git-fixes).\n- soundwire: amd: fix for clearing command status register (git-fixes).\n- soundwire: stream: restore params when prepare ports fail (git-fixes).\n- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (git-fixes).\n- sprintf.h requires stdarg.h (git-fixes).\n- sprintf.h: mask additional include (git-fixes).\n- staging: axis-fifo: remove sysfs interface (git-fixes).\n- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (git-fixes).\n- staging: nvec: Fix incorrect null termination of battery manufacturer (git-fixes).\n- staging: vchiq_arm: Make vchiq_shutdown never fail (git-fixes).\n- struct cdns: move new member to the end (git-fixes).\n- struct ucsi_operations: use padding for new operation (git-fixes).\n- sunrpc: do not immediately retransmit on seqno miss (git-fixes).\n- sunrpc: fix client side handling of tls alerts (git-fixes).\n- sunrpc: fix handling of server side tls alerts (git-fixes).\n- supported.conf: Mark ZL3073X modules supported\n- supported.conf: add missing entries for armv7hl\n- supported.conf: move nvme-apple to optional again\n- supported.conf: sort entries again\n- tcp: call tcp_measure_rcv_mss() for ooo packets (git-fixes).\n- thermal: trip: Use READ_ONCE() for lockless access to trip properties (git-fixes).\n- thermal: trip: Use common set of trip type names (git-fixes).\n- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (git-fixes).\n- thunderbolt: Fix copy+paste error in match_service_id() (git-fixes).\n- thunderbolt: Fix wake on connect at runtime (git-fixes).\n- tracing/kprobe: Make trace_kprobe's module callback called after jump_label update (git-fixes).\n- tracing/kprobes: Fix to free objects when failed to copy a symbol (git-fixes).\n- types: Complement the aligned types with signed 64-bit one (stable-fixes).\n- ucount: fix atomic_long_inc_below() argument type (git-fixes).\n- ucsi-glink: adapt to kABI consistency (git-fixes).\n- ucsi_ccg: Refine the UCSI Interrupt handling (git-fixes).\n- ucsi_operations: add stubs for all operations (git-fixes).\n- ucsi_ops: adapt update_connector to kABI consistency (git-fixes).\n- usb: Add checks for snprintf() calls in usb_alloc_dev() (stable-fixes).\n- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (git-fixes).\n- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (stable-fixes).\n- usb: cdnsp: Fix issue with CV Bad Descriptor test (git-fixes).\n- usb: cdnsp: Fix issue with resuming from L1 (git-fixes).\n- usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (stable-fixes).\n- usb: cdnsp: do not disable slot for disabled slot (git-fixes).\n- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (git-fixes).\n- usb: common: usb-conn-gpio: use a unique name for usb connector device (stable-fixes).\n- usb: dwc2: also exit clock_gating when stopping udc while suspended (stable-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: meson-g12a: fix device leaks at unbind (git-fixes).\n- usb: early: xhci-dbc: Fix early_ioremap leak (git-fixes).\n- usb: gadget : fix use-after-free in composite_dev_cleanup() (git-fixes).\n- usb: gadget: u_serial: Fix race condition in TTY wakeup (git-fixes).\n- usb: gadget: udc: renesas_usb3: fix device leak at unbind (git-fixes).\n- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (git-fixes).\n- usb: hub: Do not try to recover devices lost during warm reset (git-fixes).\n- usb: misc: apple-mfi-fastcharge: Make power supply names unique (git-fixes).\n- usb: musb: fix gadget state on disconnect (git-fixes).\n- usb: musb: omap2430: fix device leak at unbind (git-fixes).\n- usb: net: sierra: check for no status endpoint (git-fixes).\n- usb: potential integer overflow in usbg_make_tpg() (stable-fixes).\n- usb: typec: Update sysfs when setting ops (git-fixes).\n- usb: typec: altmodes/displayport: do not index invalid pin_assignments (git-fixes).\n- usb: typec: displayport: Fix potential deadlock (git-fixes).\n- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (stable-fixes).\n- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (stable-fixes).\n- usb: typec: tcpm: allow switching to mode accessory to mux properly (stable-fixes).\n- usb: typec: tcpm: allow to use sink in accessory mode (stable-fixes).\n- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (git-fixes).\n- usb: typec: ucsi: Add DATA_RESET option of Connector Reset command (git-fixes).\n- usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk (git-fixes).\n- usb: typec: ucsi: Delay alternate mode discovery (git-fixes).\n- usb: typec: ucsi: Fix busy loop on ASUS VivoBooks (git-fixes).\n- usb: typec: ucsi: Fix the partner PD revision (git-fixes).\n- usb: typec: ucsi: Get PD revision for partner (git-fixes).\n- usb: typec: ucsi: Set orientation as none when connector is unplugged (git-fixes).\n- usb: typec: ucsi: Update power_supply on power role change (git-fixes).\n- usb: typec: ucsi: add callback for connector status updates (git-fixes).\n- usb: typec: ucsi: add update_connector callback (git-fixes).\n- usb: typec: ucsi: do not retrieve PDOs if not supported (git-fixes).\n- usb: typec: ucsi: extract code to read PD caps (git-fixes).\n- usb: typec: ucsi: fix UCSI on SM8550 \u0026 SM8650 Qualcomm devices (git-fixes).\n- usb: typec: ucsi: glink: fix off-by-one in connector_status (git-fixes).\n- usb: typec: ucsi: glink: increase max ports for x1e80100 (git-fixes).\n- usb: typec: ucsi: glink: move GPIO reading into connector_status callback (git-fixes).\n- usb: typec: ucsi: glink: use typec_set_orientation (git-fixes).\n- usb: typec: ucsi: move ucsi_acknowledge() from ucsi_read_error() (git-fixes).\n- usb: typec: ucsi: properly register partner's PD device (git-fixes).\n- usb: typec: ucsi: support delaying GET_PDOS for device (git-fixes).\n- usb: typec: ucsi_acpi: Add LG Gram quirk (git-fixes).\n- usb: typec: ucsi_glink: drop NO_PARTNER_PDOS quirk for sm8550 / sm8650 (git-fixes).\n- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk (git-fixes).\n- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk on qcm6490 (git-fixes).\n- usb: typec: ucsi_glink: rework quirks implementation (git-fixes).\n- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (git-fixes).\n- usb: xhci: quirk for data loss in ISOC transfers (stable-fixes).\n- usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (stable-fixes).\n- virtgpu: do not reset on shutdown (git-fixes).\n- vmci: Prevent the dispatching of uninitialized payloads (git-fixes).\n- vt: add missing notification when switching back to text mode (stable-fixes).\n- vt: defkeymap: Map keycodes above 127 to K_HOLE (git-fixes).\n- vt: keyboard: Do not process Unicode characters in K_OFF mode (git-fixes).\n- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (git-fixes).\n- wifi: ath11k: clear initialized flag for deinit-ed srng lists (git-fixes).\n- wifi: ath11k: fix dest ring-buffer corruption (git-fixes).\n- wifi: ath11k: fix dest ring-buffer corruption when ring is full (git-fixes).\n- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (git-fixes).\n- wifi: ath11k: fix source ring-buffer corruption (git-fixes).\n- wifi: ath11k: fix suspend use-after-free after probe failure (git-fixes).\n- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (git-fixes).\n- wifi: ath12k: fix dest ring-buffer corruption (git-fixes).\n- wifi: ath12k: fix dest ring-buffer corruption when ring is full (git-fixes).\n- wifi: ath12k: fix endianness handling while accessing wmi service bit (git-fixes).\n- wifi: ath12k: fix source ring-buffer corruption (git-fixes).\n- wifi: ath6kl: remove WARN on bad firmware input (stable-fixes).\n- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (git-fixes).\n- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (git-fixes).\n- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (git-fixes).\n- wifi: cfg80211: fix S1G beacon head validation in nl80211 (git-fixes).\n- wifi: cfg80211: remove scan request n_channels counted_by (git-fixes).\n- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (git-fixes).\n- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (git-fixes).\n- wifi: iwlwifi: return ERR_PTR from opmode start() (stable-fixes).\n- wifi: mac80211: Add link iteration macro for link data (stable-fixes).\n- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (git-fixes).\n- wifi: mac80211: Create separate links for VLAN interfaces (stable-fixes).\n- wifi: mac80211: Do not call fq_flow_idx() for management frames (git-fixes).\n- wifi: mac80211: Do not schedule stopped TXQs (git-fixes).\n- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (git-fixes).\n- wifi: mac80211: chan: chandef is non-NULL for reserved (stable-fixes).\n- wifi: mac80211: drop invalid source address OCB frames (stable-fixes).\n- wifi: mac80211: finish link init before RCU publish (git-fixes).\n- wifi: mac80211: fix non-transmitted BSSID profile search (git-fixes).\n- wifi: mac80211: reject TDLS operations when station is not associated (git-fixes).\n- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (git-fixes).\n- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (git-fixes).\n- wifi: mt76: mt7925: fix the wrong config for tx interrupt (git-fixes).\n- wifi: nl80211: Set num_sub_specs before looping through sub_specs (git-fixes).\n- wifi: plfxlc: Fix error handling in usb driver probe (git-fixes).\n- wifi: prevent A-MSDU attacks in mesh networks (stable-fixes).\n- wifi: rt2x00: fix remove callback type mismatch (git-fixes).\n- wifi: rtl818x: Kill URBs before clearing tx status queue (git-fixes).\n- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (git-fixes).\n- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (git-fixes).\n- x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 (bsc#1246449).\n- x86/CPU/AMD: Improve the erratum 1386 workaround (git-fixes).\n- x86/CPU/AMD: Terminate the erratum_1386_microcode array (git-fixes).\n- x86/cpu/amd: Fix workaround for erratum 1054 (git-fixes).\n- x86/cpu: Avoid running off the end of an AMD erratum table (git-fixes).\n- x86/cpu: Expose only stepping min/max interface (git-fixes).\n- x86/cpu: Introduce new microcode matching helper (git-fixes).\n- x86/cpu: Move AMD erratum 1386 table over to 'x86_cpu_id' (git-fixes).\n- x86/cpu: Replace PEBS use of 'x86_cpu_desc' use with 'x86_cpu_id' (git-fixes).\n- x86/mce/amd: Add default names for MCA banks and blocks (git-fixes).\n- x86/mce/amd: Fix threshold limit reset (git-fixes).\n- x86/mce: Do not remove sysfs if thresholding sysfs init fails (git-fixes).\n- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (git-fixes).\n- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (git-fixes).\n- x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).\n- x86/traps: Initialize DR6 by writing its architectural reset value (git-fixes).\n- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (git-fixes).\n- x86: UV RTC: Add parameter to disable RTC clocksource (bsc#1241345).\n- xfs: fix off-by-one error in fsmap's end_daddr usage (bsc#1235837).\n- xfs: only create event xfs_file_compat_ioctl when CONFIG_COMPAT is configure (git-fixes).\n- xfs: remove unused event xfs_alloc_near_error (git-fixes).\n- xfs: remove unused event xfs_alloc_near_nominleft (git-fixes).\n- xfs: remove unused event xfs_attr_node_removename (git-fixes).\n- xfs: remove unused event xfs_ioctl_clone (git-fixes).\n- xfs: remove unused event xfs_pagecache_inval (git-fixes).\n- xfs: remove unused event xlog_iclog_want_sync (git-fixes).\n- xfs: remove unused trace event xfs_attr_remove_iter_return (git-fixes).\n- xfs: remove unused trace event xfs_attr_rmtval_set (git-fixes).\n- xfs: remove unused trace event xfs_reflink_cow_enospc (git-fixes).\n- xfs: remove unused xfs_attr events (git-fixes).\n- xfs: remove unused xfs_reflink_compare_extents events (git-fixes).\n- xfs: remove usused xfs_end_io_direct events (git-fixes).\n- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (git-fixes).\n- xhci: dbc: Flush queued requests before stopping dbc (git-fixes).\n- xhci: dbctty: disable ECHO flag by default (git-fixes).\n","status":"published","published":"2025-08-28T12:06:15Z","modified":"2026-03-23T04:47:56.876997Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:23066-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T20:56:24Z","modified":"2026-08-15T18:23:51.257464779Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23068-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-15T18:23:51.243537972Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23221-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-27T18:23:09.328001936Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23231-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-27T18:23:10.279362294Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23237-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:34:22Z","modified":"2026-08-27T18:23:10.81084318Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"USN-7833-1","title":"linux, linux-aws, linux-gcp, linux-oem-6.14, linux-oracle, linux-oracle-6.14, linux-raspi, linux-realtime vulnerabilities","description":"Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - Ublk userspace block driver;\n  - Bus devices;\n  - DMA engine subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - Cirrus firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - TI TPS6594 PFSM driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - x86 platform drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - ChipIdea USB driver;\n  - USB Type-C support driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - SMB network file system;\n  - Memory Management;\n  - Bluetooth subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - BPF subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Scheduler infrastructure;\n  - Maple Tree data structure library;\n  - Memory management;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv6 networking;\n  - MultiProtocol Label Switching driver;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - WCD audio codecs;\n  - USB sound devices;\n(CVE-2025-38339, CVE-2025-38391, CVE-2025-38262, CVE-2025-38345,\nCVE-2025-38387, CVE-2025-38373, CVE-2025-38395, CVE-2025-38330,\nCVE-2025-38425, CVE-2025-38210, CVE-2025-38206, CVE-2025-38219,\nCVE-2025-38245, CVE-2025-38253, CVE-2025-38401, CVE-2025-38410,\nCVE-2025-38086, CVE-2025-38340, CVE-2025-38368, CVE-2025-38385,\nCVE-2025-38384, CVE-2025-38326, CVE-2025-38224, CVE-2025-38338,\nCVE-2025-38191, CVE-2025-39682, CVE-2025-38343, CVE-2025-38090,\nCVE-2025-38228, CVE-2025-38182, CVE-2025-38231, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38237, CVE-2025-38413, CVE-2025-38356,\nCVE-2025-38246, CVE-2025-38202, CVE-2025-38248, CVE-2025-38254,\nCVE-2025-38426, CVE-2025-38429, CVE-2025-38364, CVE-2025-38388,\nCVE-2025-38435, CVE-2025-38403, CVE-2025-38186, CVE-2025-38199,\nCVE-2025-38402, CVE-2025-38181, CVE-2025-38264, CVE-2025-38362,\nCVE-2025-38341, CVE-2025-38422, CVE-2025-38331, CVE-2025-38423,\nCVE-2025-38233, CVE-2025-38337, CVE-2025-38328, CVE-2025-38196,\nCVE-2025-38412, CVE-2025-38205, CVE-2025-38242, CVE-2025-38324,\nCVE-2025-38354, CVE-2025-38347, CVE-2025-38217, CVE-2025-38393,\nCVE-2025-38392, CVE-2025-38390, CVE-2025-38321, CVE-2025-38541,\nCVE-2025-38363, CVE-2025-38203, CVE-2025-38250, CVE-2025-38418,\nCVE-2025-38336, CVE-2025-38333, CVE-2025-38194, CVE-2025-38372,\nCVE-2025-38348, CVE-2025-38370, CVE-2025-38411, CVE-2025-38188,\nCVE-2025-38365, CVE-2025-38241, CVE-2025-38201, CVE-2025-38259,\nCVE-2025-38355, CVE-2025-38227, CVE-2025-38225, CVE-2025-38405,\nCVE-2025-38329, CVE-2025-38232, CVE-2025-38344, CVE-2025-38238,\nCVE-2025-38239, CVE-2025-38260, CVE-2025-38257, CVE-2025-38399,\nCVE-2025-38419, CVE-2025-38430, CVE-2025-38251, CVE-2025-38332,\nCVE-2025-38220, CVE-2025-38417, CVE-2025-38396, CVE-2025-38234,\nCVE-2025-38434, CVE-2025-38197, CVE-2025-38436, CVE-2025-38408,\nCVE-2025-38204, CVE-2025-38222, CVE-2025-38361, CVE-2025-38218,\nCVE-2025-38212, CVE-2025-38198, CVE-2025-38255, CVE-2025-38389,\nCVE-2025-38085, CVE-2025-38244, CVE-2025-38089, CVE-2025-38428,\nCVE-2025-38369, CVE-2025-38189, CVE-2025-38084, CVE-2025-38400,\nCVE-2025-38382, CVE-2025-38223, CVE-2025-38325, CVE-2025-38263,\nCVE-2025-38249, CVE-2025-38346, CVE-2025-38320, CVE-2025-38409,\nCVE-2025-38374, CVE-2025-38208, CVE-2025-38256, CVE-2025-38371,\nCVE-2025-38192, CVE-2025-38406, CVE-2025-38360, CVE-2025-38258,\nCVE-2025-38226, CVE-2025-38376, CVE-2025-38375, CVE-2025-38200,\nCVE-2025-38523, CVE-2025-38334, CVE-2025-38236, CVE-2025-38386,\nCVE-2025-38421, CVE-2025-38087, CVE-2025-38416, CVE-2025-38179,\nCVE-2025-38420, CVE-2025-38424, CVE-2025-38377, CVE-2025-38359,\nCVE-2025-38342, CVE-2025-38431, CVE-2025-38407, CVE-2025-38427,\nCVE-2025-38229, CVE-2025-38353, CVE-2025-38383, CVE-2025-38211,\nCVE-2025-38322, CVE-2025-38381, CVE-2025-38261)\n","status":"published","published":"2025-10-21T23:56:35Z","modified":"2026-11-03T14:34:01.130720923Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7833-2","title":"linux-realtime-6.14 vulnerabilities","description":"Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - Ublk userspace block driver;\n  - Bus devices;\n  - DMA engine subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - Cirrus firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - TI TPS6594 PFSM driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - x86 platform drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - ChipIdea USB driver;\n  - USB Type-C support driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - SMB network file system;\n  - Memory Management;\n  - Bluetooth subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - BPF subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Scheduler infrastructure;\n  - Maple Tree data structure library;\n  - Memory management;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv6 networking;\n  - MultiProtocol Label Switching driver;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - WCD audio codecs;\n  - USB sound devices;\n(CVE-2025-38339, CVE-2025-38391, CVE-2025-38262, CVE-2025-38345,\nCVE-2025-38387, CVE-2025-38373, CVE-2025-38395, CVE-2025-38330,\nCVE-2025-38425, CVE-2025-38210, CVE-2025-38206, CVE-2025-38219,\nCVE-2025-38245, CVE-2025-38253, CVE-2025-38401, CVE-2025-38410,\nCVE-2025-38086, CVE-2025-38340, CVE-2025-38368, CVE-2025-38385,\nCVE-2025-38384, CVE-2025-38326, CVE-2025-38224, CVE-2025-38338,\nCVE-2025-38191, CVE-2025-39682, CVE-2025-38343, CVE-2025-38090,\nCVE-2025-38228, CVE-2025-38182, CVE-2025-38231, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38237, CVE-2025-38413, CVE-2025-38356,\nCVE-2025-38246, CVE-2025-38202, CVE-2025-38248, CVE-2025-38254,\nCVE-2025-38426, CVE-2025-38429, CVE-2025-38364, CVE-2025-38388,\nCVE-2025-38435, CVE-2025-38403, CVE-2025-38186, CVE-2025-38199,\nCVE-2025-38402, CVE-2025-38181, CVE-2025-38264, CVE-2025-38362,\nCVE-2025-38341, CVE-2025-38422, CVE-2025-38331, CVE-2025-38423,\nCVE-2025-38233, CVE-2025-38337, CVE-2025-38328, CVE-2025-38196,\nCVE-2025-38412, CVE-2025-38205, CVE-2025-38242, CVE-2025-38324,\nCVE-2025-38354, CVE-2025-38347, CVE-2025-38217, CVE-2025-38393,\nCVE-2025-38392, CVE-2025-38390, CVE-2025-38321, CVE-2025-38541,\nCVE-2025-38363, CVE-2025-38203, CVE-2025-38250, CVE-2025-38418,\nCVE-2025-38336, CVE-2025-38333, CVE-2025-38194, CVE-2025-38372,\nCVE-2025-38348, CVE-2025-38370, CVE-2025-38411, CVE-2025-38188,\nCVE-2025-38365, CVE-2025-38241, CVE-2025-38201, CVE-2025-38259,\nCVE-2025-38355, CVE-2025-38227, CVE-2025-38225, CVE-2025-38405,\nCVE-2025-38329, CVE-2025-38232, CVE-2025-38344, CVE-2025-38238,\nCVE-2025-38239, CVE-2025-38260, CVE-2025-38257, CVE-2025-38399,\nCVE-2025-38419, CVE-2025-38430, CVE-2025-38251, CVE-2025-38332,\nCVE-2025-38220, CVE-2025-38417, CVE-2025-38396, CVE-2025-38234,\nCVE-2025-38434, CVE-2025-38197, CVE-2025-38436, CVE-2025-38408,\nCVE-2025-38204, CVE-2025-38222, CVE-2025-38361, CVE-2025-38218,\nCVE-2025-38212, CVE-2025-38198, CVE-2025-38255, CVE-2025-38389,\nCVE-2025-38085, CVE-2025-38244, CVE-2025-38089, CVE-2025-38428,\nCVE-2025-38369, CVE-2025-38189, CVE-2025-38084, CVE-2025-38400,\nCVE-2025-38382, CVE-2025-38223, CVE-2025-38325, CVE-2025-38263,\nCVE-2025-38249, CVE-2025-38346, CVE-2025-38320, CVE-2025-38409,\nCVE-2025-38374, CVE-2025-38208, CVE-2025-38256, CVE-2025-38371,\nCVE-2025-38192, CVE-2025-38406, CVE-2025-38360, CVE-2025-38258,\nCVE-2025-38226, CVE-2025-38376, CVE-2025-38375, CVE-2025-38200,\nCVE-2025-38523, CVE-2025-38334, CVE-2025-38236, CVE-2025-38386,\nCVE-2025-38421, CVE-2025-38087, CVE-2025-38416, CVE-2025-38179,\nCVE-2025-38420, CVE-2025-38424, CVE-2025-38377, CVE-2025-38359,\nCVE-2025-38342, CVE-2025-38431, CVE-2025-38407, CVE-2025-38427,\nCVE-2025-38229, CVE-2025-38353, CVE-2025-38383, CVE-2025-38211,\nCVE-2025-38322, CVE-2025-38381, CVE-2025-38261)\n","status":"published","published":"2025-10-22T00:27:11Z","modified":"2026-11-03T14:34:03.21541899Z","updated_at":"2026-11-03T15:17:11.325641Z"},{"id":"USN-7833-3","title":"linux-aws-6.14 vulnerabilities","description":"Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - Ublk userspace block driver;\n  - Bus devices;\n  - DMA engine subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - Cirrus firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - TI TPS6594 PFSM driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - x86 platform drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - ChipIdea USB driver;\n  - USB Type-C support driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - SMB network file system;\n  - Memory Management;\n  - Bluetooth subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - BPF subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Scheduler infrastructure;\n  - Maple Tree data structure library;\n  - Memory management;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv6 networking;\n  - MultiProtocol Label Switching driver;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - WCD audio codecs;\n  - USB sound devices;\n(CVE-2025-38339, CVE-2025-38391, CVE-2025-38262, CVE-2025-38345,\nCVE-2025-38387, CVE-2025-38373, CVE-2025-38395, CVE-2025-38330,\nCVE-2025-38425, CVE-2025-38210, CVE-2025-38206, CVE-2025-38219,\nCVE-2025-38245, CVE-2025-38253, CVE-2025-38401, CVE-2025-38410,\nCVE-2025-38086, CVE-2025-38340, CVE-2025-38368, CVE-2025-38385,\nCVE-2025-38384, CVE-2025-38326, CVE-2025-38224, CVE-2025-38338,\nCVE-2025-38191, CVE-2025-39682, CVE-2025-38343, CVE-2025-38090,\nCVE-2025-38228, CVE-2025-38182, CVE-2025-38231, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38237, CVE-2025-38413, CVE-2025-38356,\nCVE-2025-38246, CVE-2025-38202, CVE-2025-38248, CVE-2025-38254,\nCVE-2025-38426, CVE-2025-38429, CVE-2025-38364, CVE-2025-38388,\nCVE-2025-38435, CVE-2025-38403, CVE-2025-38186, CVE-2025-38199,\nCVE-2025-38402, CVE-2025-38181, CVE-2025-38264, CVE-2025-38362,\nCVE-2025-38341, CVE-2025-38422, CVE-2025-38331, CVE-2025-38423,\nCVE-2025-38233, CVE-2025-38337, CVE-2025-38328, CVE-2025-38196,\nCVE-2025-38412, CVE-2025-38205, CVE-2025-38242, CVE-2025-38324,\nCVE-2025-38354, CVE-2025-38347, CVE-2025-38217, CVE-2025-38393,\nCVE-2025-38392, CVE-2025-38390, CVE-2025-38321, CVE-2025-38541,\nCVE-2025-38363, CVE-2025-38203, CVE-2025-38250, CVE-2025-38418,\nCVE-2025-38336, CVE-2025-38333, CVE-2025-38194, CVE-2025-38372,\nCVE-2025-38348, CVE-2025-38370, CVE-2025-38411, CVE-2025-38188,\nCVE-2025-38365, CVE-2025-38241, CVE-2025-38201, CVE-2025-38259,\nCVE-2025-38355, CVE-2025-38227, CVE-2025-38225, CVE-2025-38405,\nCVE-2025-38329, CVE-2025-38232, CVE-2025-38344, CVE-2025-38238,\nCVE-2025-38239, CVE-2025-38260, CVE-2025-38257, CVE-2025-38399,\nCVE-2025-38419, CVE-2025-38430, CVE-2025-38251, CVE-2025-38332,\nCVE-2025-38220, CVE-2025-38417, CVE-2025-38396, CVE-2025-38234,\nCVE-2025-38434, CVE-2025-38197, CVE-2025-38436, CVE-2025-38408,\nCVE-2025-38204, CVE-2025-38222, CVE-2025-38361, CVE-2025-38218,\nCVE-2025-38212, CVE-2025-38198, CVE-2025-38255, CVE-2025-38389,\nCVE-2025-38085, CVE-2025-38244, CVE-2025-38089, CVE-2025-38428,\nCVE-2025-38369, CVE-2025-38189, CVE-2025-38084, CVE-2025-38400,\nCVE-2025-38382, CVE-2025-38223, CVE-2025-38325, CVE-2025-38263,\nCVE-2025-38249, CVE-2025-38346, CVE-2025-38320, CVE-2025-38409,\nCVE-2025-38374, CVE-2025-38208, CVE-2025-38256, CVE-2025-38371,\nCVE-2025-38192, CVE-2025-38406, CVE-2025-38360, CVE-2025-38258,\nCVE-2025-38226, CVE-2025-38376, CVE-2025-38375, CVE-2025-38200,\nCVE-2025-38523, CVE-2025-38334, CVE-2025-38236, CVE-2025-38386,\nCVE-2025-38421, CVE-2025-38087, CVE-2025-38416, CVE-2025-38179,\nCVE-2025-38420, CVE-2025-38424, CVE-2025-38377, CVE-2025-38359,\nCVE-2025-38342, CVE-2025-38431, CVE-2025-38407, CVE-2025-38427,\nCVE-2025-38229, CVE-2025-38353, CVE-2025-38383, CVE-2025-38211,\nCVE-2025-38322, CVE-2025-38381, CVE-2025-38261)\n","status":"published","published":"2025-10-24T20:29:03Z","modified":"2026-11-03T14:33:58.332086108Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7833-4","title":"linux-gcp-6.14 vulnerabilities","description":"Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - Ublk userspace block driver;\n  - Bus devices;\n  - DMA engine subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - Cirrus firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - TI TPS6594 PFSM driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - x86 platform drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - ChipIdea USB driver;\n  - USB Type-C support driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - SMB network file system;\n  - Memory Management;\n  - Bluetooth subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - BPF subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Scheduler infrastructure;\n  - Maple Tree data structure library;\n  - Memory management;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv6 networking;\n  - MultiProtocol Label Switching driver;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - WCD audio codecs;\n  - USB sound devices;\n(CVE-2025-38339, CVE-2025-38391, CVE-2025-38262, CVE-2025-38345,\nCVE-2025-38387, CVE-2025-38373, CVE-2025-38395, CVE-2025-38330,\nCVE-2025-38425, CVE-2025-38210, CVE-2025-38206, CVE-2025-38219,\nCVE-2025-38245, CVE-2025-38253, CVE-2025-38401, CVE-2025-38410,\nCVE-2025-38086, CVE-2025-38340, CVE-2025-38368, CVE-2025-38385,\nCVE-2025-38384, CVE-2025-38326, CVE-2025-38224, CVE-2025-38338,\nCVE-2025-38191, CVE-2025-39682, CVE-2025-38343, CVE-2025-38090,\nCVE-2025-38228, CVE-2025-38182, CVE-2025-38231, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38237, CVE-2025-38413, CVE-2025-38356,\nCVE-2025-38246, CVE-2025-38202, CVE-2025-38248, CVE-2025-38254,\nCVE-2025-38426, CVE-2025-38429, CVE-2025-38364, CVE-2025-38388,\nCVE-2025-38435, CVE-2025-38403, CVE-2025-38186, CVE-2025-38199,\nCVE-2025-38402, CVE-2025-38181, CVE-2025-38264, CVE-2025-38362,\nCVE-2025-38341, CVE-2025-38422, CVE-2025-38331, CVE-2025-38423,\nCVE-2025-38233, CVE-2025-38337, CVE-2025-38328, CVE-2025-38196,\nCVE-2025-38412, CVE-2025-38205, CVE-2025-38242, CVE-2025-38324,\nCVE-2025-38354, CVE-2025-38347, CVE-2025-38217, CVE-2025-38393,\nCVE-2025-38392, CVE-2025-38390, CVE-2025-38321, CVE-2025-38541,\nCVE-2025-38363, CVE-2025-38203, CVE-2025-38250, CVE-2025-38418,\nCVE-2025-38336, CVE-2025-38333, CVE-2025-38194, CVE-2025-38372,\nCVE-2025-38348, CVE-2025-38370, CVE-2025-38411, CVE-2025-38188,\nCVE-2025-38365, CVE-2025-38241, CVE-2025-38201, CVE-2025-38259,\nCVE-2025-38355, CVE-2025-38227, CVE-2025-38225, CVE-2025-38405,\nCVE-2025-38329, CVE-2025-38232, CVE-2025-38344, CVE-2025-38238,\nCVE-2025-38239, CVE-2025-38260, CVE-2025-38257, CVE-2025-38399,\nCVE-2025-38419, CVE-2025-38430, CVE-2025-38251, CVE-2025-38332,\nCVE-2025-38220, CVE-2025-38417, CVE-2025-38396, CVE-2025-38234,\nCVE-2025-38434, CVE-2025-38197, CVE-2025-38436, CVE-2025-38408,\nCVE-2025-38204, CVE-2025-38222, CVE-2025-38361, CVE-2025-38218,\nCVE-2025-38212, CVE-2025-38198, CVE-2025-38255, CVE-2025-38389,\nCVE-2025-38085, CVE-2025-38244, CVE-2025-38089, CVE-2025-38428,\nCVE-2025-38369, CVE-2025-38189, CVE-2025-38084, CVE-2025-38400,\nCVE-2025-38382, CVE-2025-38223, CVE-2025-38325, CVE-2025-38263,\nCVE-2025-38249, CVE-2025-38346, CVE-2025-38320, CVE-2025-38409,\nCVE-2025-38374, CVE-2025-38208, CVE-2025-38256, CVE-2025-38371,\nCVE-2025-38192, CVE-2025-38406, CVE-2025-38360, CVE-2025-38258,\nCVE-2025-38226, CVE-2025-38376, CVE-2025-38375, CVE-2025-38200,\nCVE-2025-38523, CVE-2025-38334, CVE-2025-38236, CVE-2025-38386,\nCVE-2025-38421, CVE-2025-38087, CVE-2025-38416, CVE-2025-38179,\nCVE-2025-38420, CVE-2025-38424, CVE-2025-38377, CVE-2025-38359,\nCVE-2025-38342, CVE-2025-38431, CVE-2025-38407, CVE-2025-38427,\nCVE-2025-38229, CVE-2025-38353, CVE-2025-38383, CVE-2025-38211,\nCVE-2025-38322, CVE-2025-38381, CVE-2025-38261)\n","status":"published","published":"2025-10-31T14:21:25Z","modified":"2026-11-03T14:33:59.365828667Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7834-1","title":"linux-azure, linux-azure-6.14, linux-azure-nvidia-6.14 vulnerabilities","description":"Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - Ublk userspace block driver;\n  - Bus devices;\n  - DMA engine subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - Cirrus firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - TI TPS6594 PFSM driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - x86 platform drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - ChipIdea USB driver;\n  - USB Type-C support driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - SMB network file system;\n  - Memory Management;\n  - Bluetooth subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - BPF subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Scheduler infrastructure;\n  - Maple Tree data structure library;\n  - Memory management;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv6 networking;\n  - MultiProtocol Label Switching driver;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - WCD audio codecs;\n  - USB sound devices;\n(CVE-2025-38217, CVE-2025-38259, CVE-2025-38257, CVE-2025-38388,\nCVE-2025-38258, CVE-2025-38086, CVE-2025-38416, CVE-2025-38428,\nCVE-2025-38368, CVE-2025-38233, CVE-2025-38391, CVE-2025-38364,\nCVE-2025-38328, CVE-2025-38417, CVE-2025-38228, CVE-2025-38413,\nCVE-2025-38360, CVE-2025-38248, CVE-2025-38346, CVE-2025-38197,\nCVE-2025-38179, CVE-2025-38186, CVE-2025-38356, CVE-2025-38371,\nCVE-2025-38231, CVE-2025-38249, CVE-2025-38334, CVE-2025-38325,\nCVE-2025-38353, CVE-2025-38422, CVE-2025-38387, CVE-2025-38225,\nCVE-2025-38224, CVE-2025-38400, CVE-2025-38245, CVE-2025-38411,\nCVE-2025-38205, CVE-2025-38362, CVE-2025-38200, CVE-2025-38250,\nCVE-2025-38541, CVE-2025-38326, CVE-2025-38342, CVE-2025-38208,\nCVE-2025-38261, CVE-2025-38407, CVE-2025-38202, CVE-2025-38331,\nCVE-2025-38189, CVE-2025-38090, CVE-2025-38184, CVE-2025-38255,\nCVE-2025-38419, CVE-2025-38340, CVE-2025-38383, CVE-2025-38423,\nCVE-2025-38332, CVE-2025-38246, CVE-2025-38429, CVE-2025-38410,\nCVE-2025-38396, CVE-2025-38262, CVE-2025-38191, CVE-2025-38420,\nCVE-2025-38226, CVE-2025-38341, CVE-2025-38199, CVE-2025-38085,\nCVE-2025-38188, CVE-2025-38253, CVE-2025-38182, CVE-2025-38087,\nCVE-2025-38203, CVE-2025-38194, CVE-2025-38227, CVE-2025-38365,\nCVE-2025-38238, CVE-2025-38201, CVE-2025-38196, CVE-2025-38232,\nCVE-2025-38361, CVE-2025-38392, CVE-2025-38254, CVE-2025-38370,\nCVE-2025-38192, CVE-2025-38229, CVE-2025-38241, CVE-2025-38222,\nCVE-2025-38337, CVE-2025-38343, CVE-2025-38321, CVE-2025-38183,\nCVE-2025-38381, CVE-2025-38354, CVE-2025-38234, CVE-2025-38385,\nCVE-2025-38239, CVE-2025-38218, CVE-2025-38426, CVE-2025-38330,\nCVE-2025-38427, CVE-2025-38523, CVE-2025-38260, CVE-2025-38425,\nCVE-2025-38320, CVE-2025-38424, CVE-2025-38372, CVE-2025-38412,\nCVE-2025-38434, CVE-2025-38089, CVE-2025-38322, CVE-2025-38236,\nCVE-2025-38339, CVE-2025-38237, CVE-2025-38386, CVE-2025-38395,\nCVE-2025-38431, CVE-2025-38329, CVE-2025-38436, CVE-2025-38369,\nCVE-2025-38405, CVE-2025-38204, CVE-2025-38374, CVE-2025-38263,\nCVE-2025-38181, CVE-2025-38363, CVE-2025-38084, CVE-2025-38206,\nCVE-2025-38359, CVE-2025-38347, CVE-2025-38421, CVE-2025-38418,\nCVE-2025-38375, CVE-2025-38389, CVE-2025-38373, CVE-2025-38403,\nCVE-2025-38348, CVE-2025-38399, CVE-2025-38242, CVE-2025-38393,\nCVE-2025-38336, CVE-2025-38264, CVE-2025-38408, CVE-2025-38384,\nCVE-2025-38406, CVE-2025-38382, CVE-2025-38211, CVE-2025-38220,\nCVE-2025-38376, CVE-2025-38401, CVE-2025-38344, CVE-2025-38223,\nCVE-2025-38251, CVE-2025-38324, CVE-2025-38402, CVE-2025-38198,\nCVE-2025-38210, CVE-2025-38377, CVE-2025-38345, CVE-2025-38219,\nCVE-2025-39682, CVE-2025-38355, CVE-2025-38333, CVE-2025-38338,\nCVE-2025-38256, CVE-2025-38390, CVE-2025-38435, CVE-2025-38430,\nCVE-2025-38409, CVE-2025-38212)\n","status":"published","published":"2025-10-22T00:02:00Z","modified":"2026-11-03T14:34:00.502383631Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7856-1","title":"linux-hwe-6.14 vulnerabilities","description":"Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - Ublk userspace block driver;\n  - Bus devices;\n  - DMA engine subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - Cirrus firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - TI TPS6594 PFSM driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - x86 platform drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - ChipIdea USB driver;\n  - USB Type-C support driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - SMB network file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Memory Management;\n  - Bluetooth subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - BPF subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Scheduler infrastructure;\n  - Maple Tree data structure library;\n  - Memory management;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv6 networking;\n  - MultiProtocol Label Switching driver;\n  - Netfilter;\n  - NFC subsystem;\n  - Rose network layer;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - WCD audio codecs;\n  - USB sound devices;\n(CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38087,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38179, CVE-2025-38180,\nCVE-2025-38181, CVE-2025-38182, CVE-2025-38183, CVE-2025-38184,\nCVE-2025-38185, CVE-2025-38186, CVE-2025-38188, CVE-2025-38189,\nCVE-2025-38190, CVE-2025-38191, CVE-2025-38192, CVE-2025-38193,\nCVE-2025-38194, CVE-2025-38196, CVE-2025-38197, CVE-2025-38198,\nCVE-2025-38199, CVE-2025-38200, CVE-2025-38201, CVE-2025-38202,\nCVE-2025-38203, CVE-2025-38204, CVE-2025-38205, CVE-2025-38206,\nCVE-2025-38208, CVE-2025-38210, CVE-2025-38211, CVE-2025-38212,\nCVE-2025-38214, CVE-2025-38215, CVE-2025-38217, CVE-2025-38218,\nCVE-2025-38219, CVE-2025-38220, CVE-2025-38222, CVE-2025-38223,\nCVE-2025-38224, CVE-2025-38225, CVE-2025-38226, CVE-2025-38227,\nCVE-2025-38228, CVE-2025-38229, CVE-2025-38230, CVE-2025-38231,\nCVE-2025-38232, CVE-2025-38233, CVE-2025-38234, CVE-2025-38236,\nCVE-2025-38237, CVE-2025-38238, CVE-2025-38239, CVE-2025-38241,\nCVE-2025-38242, CVE-2025-38244, CVE-2025-38245, CVE-2025-38246,\nCVE-2025-38248, CVE-2025-38249, CVE-2025-38250, CVE-2025-38251,\nCVE-2025-38253, CVE-2025-38254, CVE-2025-38255, CVE-2025-38256,\nCVE-2025-38257, CVE-2025-38258, CVE-2025-38259, CVE-2025-38260,\nCVE-2025-38261, CVE-2025-38262, CVE-2025-38263, CVE-2025-38264,\nCVE-2025-38320, CVE-2025-38321, CVE-2025-38322, CVE-2025-38323,\nCVE-2025-38324, CVE-2025-38325, CVE-2025-38326, CVE-2025-38328,\nCVE-2025-38329, CVE-2025-38330, CVE-2025-38331, CVE-2025-38332,\nCVE-2025-38333, CVE-2025-38334, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38339, CVE-2025-38340, CVE-2025-38341,\nCVE-2025-38342, CVE-2025-38343, CVE-2025-38344, CVE-2025-38345,\nCVE-2025-38346, CVE-2025-38347, CVE-2025-38348, CVE-2025-38353,\nCVE-2025-38354, CVE-2025-38355, CVE-2025-38356, CVE-2025-38359,\nCVE-2025-38360, CVE-2025-38361, CVE-2025-38362, CVE-2025-38363,\nCVE-2025-38364, CVE-2025-38365, CVE-2025-38368, CVE-2025-38369,\nCVE-2025-38370, CVE-2025-38371, CVE-2025-38372, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38381, CVE-2025-38382, CVE-2025-38383, CVE-2025-38384,\nCVE-2025-38385, CVE-2025-38386, CVE-2025-38387, CVE-2025-38388,\nCVE-2025-38389, CVE-2025-38390, CVE-2025-38391, CVE-2025-38392,\nCVE-2025-38393, CVE-2025-38395, CVE-2025-38396, CVE-2025-38399,\nCVE-2025-38400, CVE-2025-38401, CVE-2025-38402, CVE-2025-38403,\nCVE-2025-38405, CVE-2025-38406, CVE-2025-38407, CVE-2025-38408,\nCVE-2025-38409, CVE-2025-38410, CVE-2025-38411, CVE-2025-38412,\nCVE-2025-38413, CVE-2025-38416, CVE-2025-38417, CVE-2025-38418,\nCVE-2025-38419, CVE-2025-38420, CVE-2025-38421, CVE-2025-38422,\nCVE-2025-38423, CVE-2025-38424, CVE-2025-38425, CVE-2025-38426,\nCVE-2025-38427, CVE-2025-38428, CVE-2025-38429, CVE-2025-38430,\nCVE-2025-38431, CVE-2025-38434, CVE-2025-38435, CVE-2025-38436,\nCVE-2025-38523, CVE-2025-38541, CVE-2025-39682)\n","status":"published","published":"2025-11-04T14:19:33Z","modified":"2026-06-03T14:04:22.346927298Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}