{"id":"CVE-2025-38469","aliases":["BELL-CVE-2025-38469","DEBIAN-CVE-2025-38469","DSA-5975-1","EUVD-2025-22893","GHSA-632w-7gxq-vxq4","MGASA-2025-0218","MGASA-2025-0219","ROOT-OS-UBUNTU-2404-CVE-2025-38469","SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23193-1","SUSE-SU-2026:23194-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:23241-1","SUSE-SU-2026:23244-1","SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:3790-1","SUSE-SU-2026:3810-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","SUSE-SU-2026:4369-1","UBUNTU-CVE-2025-38469","USN-7879-1","USN-7879-2","USN-7879-3","USN-7879-4","USN-7880-1","USN-7934-1","USN-8028-1","USN-8028-2","USN-8028-3","USN-8028-4","USN-8028-5","USN-8028-6","USN-8028-7","USN-8028-8","USN-8031-1","USN-8031-2","USN-8031-3","USN-8052-1","USN-8052-2","USN-8074-1","USN-8074-2","USN-8126-1","openSUSE-SU-2026:21555-1"],"status":"published","title":"KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00179,"percentile":0.0755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-07-28T11:21:30Z","modified":"2026-11-06T16:16:50Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.6.100","6.12.40","6.15.8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.41-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.16.3-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1046.49~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1051.57~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","fixed_in":["6.8.0-1046.53~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1047.50~22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-100.100~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1044.44~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-100.100.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1046.49~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1043.44~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-100.100~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1041.42~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-100.100"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1046.49"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","fixed_in":["6.14.0-1017.17~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1046.52"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","fixed_in":["6.14.0-1017.17~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","fixed_in":["6.8.0-1046.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1047.50"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","fixed_in":["6.14.0-1020.21~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1043.48"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1030.33"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1044.44"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-100.100.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1046.49"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1046.49.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1020.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","fixed_in":["6.14.0-1016.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1043.44"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","fixed_in":["6.14.0-1017.17~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1047.51"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","fixed_in":["6.14.0-36.36.1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","fixed_in":["6.8.0-1023.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","fixed_in":["6.8.0-1016.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2037.38"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1041.42"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","fixed_in":["6.14.0-1016.16~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","fixed_in":["6.8.0-1046.49+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","fixed_in":["6.8.0-1046.52+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","fixed_in":["6.8.0-100.100+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","fixed_in":["6.8.0-1047.50+fips1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.89-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.100"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.15.8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.41-1"}]}],"versions":["6.12.38-1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.3-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1~bpo13+1","6.16~rc7-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.41-1"}]}],"versions":["6.12.38-1"],"bundled":66},{"source":"osv","ecosystem":"Mageia:9","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.101-1.mga9"}]}],"bundled":237},{"source":"osv","ecosystem":"Mageia:9","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.101-1.mga9"}]}],"bundled":237},{"source":"osv","ecosystem":"Mageia:9","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.10-7.mga9"}]}],"bundled":237},{"source":"osv","ecosystem":"Mageia:9","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24-83.mga9"}]}],"bundled":237},{"source":"osv","ecosystem":"Mageia:9","package":"wireless-regdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250710-1.mga9"}]}],"bundled":237},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":648},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":648},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":647},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":647},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":647},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":648},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":648},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":647},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":647},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-51.1"}]}],"bundled":647},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1.21.36"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1.21.34"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1.150700.17.43.2"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.2"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.78.1"}]}],"bundled":268},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.5.1"}]}],"bundled":267},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.72.1"}]}],"bundled":267},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.72.1"}]}],"bundled":267},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.72.1"}]}],"bundled":267},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.75.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.75.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.75.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1.150700.17.45.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_31","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"bundled":131},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.53~22.04.1"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.50~22.04.2"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1044.44~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1043.44~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1041.42~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1017.17~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.52"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1017.17~24.04.1"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.53"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.50"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1020.21~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1043.48"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1030.33"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1044.44"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-intel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1005.12","6.8.0-1006.13","6.8.0-1007.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1020.20"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1016.16"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1043.44"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1017.17~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.51"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-36.36.1~24.04.1"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1023.24"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1016.20"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2037.38"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1041.42"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1016.16~24.04.1"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.52+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100+fips1"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.50+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-36.36~24.04.1"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1"],"bundled":200},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1016.16~24.04.1"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1"],"bundled":200},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1017.17~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1"],"bundled":200},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1017.17~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1"],"bundled":200},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1020.21~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1"],"bundled":200},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1016.16"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15"],"bundled":197},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1017.17~24.04.1"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"],"bundled":205},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.51"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1041.42~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2037.38"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1041.42"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100+fips1"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1043.44~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1030.33"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1043.44"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.49.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1044.44~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1044.44"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.50~22.04.2"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1"],"bundled":752},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.50+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1"],"bundled":752},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.50"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49"],"bundled":752},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1043.48"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47"],"bundled":752},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-100.100.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1023.24"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.52"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.52+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1"],"bundled":753},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1"],"bundled":1179},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/3ee59c38ae7369ad1f7b846e05633ccf0d159fab","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/fd627ac8a5cff4d45269f164b13ddddc0726f2cc","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/061c553c66bc1638c280739999224c8000fd4602","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/5a53249d149f48b558368c5338b9921b76a12f8c","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38469","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-632w-7gxq-vxq4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-38469","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38469.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-38469","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0218.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34530","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.94","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.95","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.96","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.97","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.98","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.99","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.100","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.101","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2025-0219.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34529","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623066-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185845","tags":["report"]},{"url":"https://bugzilla.suse.com/1234634","tags":["report"]},{"url":"https://bugzilla.suse.com/1237449","tags":["report"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1246179","tags":["report"]},{"url":"https://bugzilla.suse.com/1246182","tags":["report"]},{"url":"https://bugzilla.suse.com/1247455","tags":["report"]},{"url":"https://bugzilla.suse.com/1248480","tags":["report"]},{"url":"https://bugzilla.suse.com/1248611","tags":["report"]},{"url":"https://bugzilla.suse.com/1251966","tags":["report"]},{"url":"https://bugzilla.suse.com/1252682","tags":["report"]},{"url":"https://bugzilla.suse.com/1253262","tags":["report"]},{"url":"https://bugzilla.suse.com/1253434","tags":["report"]},{"url":"https://bugzilla.suse.com/1253454","tags":["report"]},{"url":"https://bugzilla.suse.com/1254306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255224","tags":["report"]},{"url":"https://bugzilla.suse.com/1255250","tags":["report"]},{"url":"https://bugzilla.suse.com/1255441","tags":["report"]},{"url":"https://bugzilla.suse.com/1255687","tags":["report"]},{"url":"https://bugzilla.suse.com/1257721","tags":["report"]},{"url":"https://bugzilla.suse.com/1257777","tags":["report"]},{"url":"https://bugzilla.suse.com/1258472","tags":["report"]},{"url":"https://bugzilla.suse.com/1258718","tags":["report"]},{"url":"https://bugzilla.suse.com/1259329","tags":["report"]},{"url":"https://bugzilla.suse.com/1259762","tags":["report"]},{"url":"https://bugzilla.suse.com/1259764","tags":["report"]},{"url":"https://bugzilla.suse.com/1259866","tags":["report"]},{"url":"https://bugzilla.suse.com/1259955","tags":["report"]},{"url":"https://bugzilla.suse.com/1260012","tags":["report"]},{"url":"https://bugzilla.suse.com/1260347","tags":["report"]},{"url":"https://bugzilla.suse.com/1260553","tags":["report"]},{"url":"https://bugzilla.suse.com/1260593","tags":["report"]},{"url":"https://bugzilla.suse.com/1261250","tags":["report"]},{"url":"https://bugzilla.suse.com/1261562","tags":["report"]},{"url":"https://bugzilla.suse.com/1261590","tags":["report"]},{"url":"https://bugzilla.suse.com/1262160","tags":["report"]},{"url":"https://bugzilla.suse.com/1262391","tags":["report"]},{"url":"https://bugzilla.suse.com/1262573","tags":["report"]},{"url":"https://bugzilla.suse.com/1262602","tags":["report"]},{"url":"https://bugzilla.suse.com/1262603","tags":["report"]},{"url":"https://bugzilla.suse.com/1262605","tags":["report"]},{"url":"https://bugzilla.suse.com/1262614","tags":["report"]},{"url":"https://bugzilla.suse.com/1262637","tags":["report"]},{"url":"https://bugzilla.suse.com/1262639","tags":["report"]},{"url":"https://bugzilla.suse.com/1262640","tags":["report"]},{"url":"https://bugzilla.suse.com/1262652","tags":["report"]},{"url":"https://bugzilla.suse.com/1262653","tags":["report"]},{"url":"https://bugzilla.suse.com/1262655","tags":["report"]},{"url":"https://bugzilla.suse.com/1262658","tags":["report"]},{"url":"https://bugzilla.suse.com/1262659","tags":["report"]},{"url":"https://bugzilla.suse.com/1262663","tags":["report"]},{"url":"https://bugzilla.suse.com/1262678","tags":["report"]},{"url":"https://bugzilla.suse.com/1262679","tags":["report"]},{"url":"https://bugzilla.suse.com/1262723","tags":["report"]},{"url":"https://bugzilla.suse.com/1262734","tags":["report"]},{"url":"https://bugzilla.suse.com/1262745","tags":["report"]},{"url":"https://bugzilla.suse.com/1262746","tags":["report"]},{"url":"https://bugzilla.suse.com/1262751","tags":["report"]},{"url":"https://bugzilla.suse.com/1262757","tags":["report"]},{"url":"https://bugzilla.suse.com/1262768","tags":["report"]},{"url":"https://bugzilla.suse.com/1262770","tags":["report"]},{"url":"https://bugzilla.suse.com/1262771","tags":["report"]},{"url":"https://bugzilla.suse.com/1262992","tags":["report"]},{"url":"https://bugzilla.suse.com/1262993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263008","tags":["report"]},{"url":"https://bugzilla.suse.com/1263010","tags":["report"]},{"url":"https://bugzilla.suse.com/1263011","tags":["report"]},{"url":"https://bugzilla.suse.com/1263013","tags":["report"]},{"url":"https://bugzilla.suse.com/1263014","tags":["report"]},{"url":"https://bugzilla.suse.com/1263016","tags":["report"]},{"url":"https://bugzilla.suse.com/1263017","tags":["report"]},{"url":"https://bugzilla.suse.com/1263020","tags":["report"]},{"url":"https://bugzilla.suse.com/1263025","tags":["report"]},{"url":"https://bugzilla.suse.com/1263030","tags":["report"]},{"url":"https://bugzilla.suse.com/1263031","tags":["report"]},{"url":"https://bugzilla.suse.com/1263045","tags":["report"]},{"url":"https://bugzilla.suse.com/1263055","tags":["report"]},{"url":"https://bugzilla.suse.com/1263059","tags":["report"]},{"url":"https://bugzilla.suse.com/1263061","tags":["report"]},{"url":"https://bugzilla.suse.com/1263065","tags":["report"]},{"url":"https://bugzilla.suse.com/1263073","tags":["report"]},{"url":"https://bugzilla.suse.com/1263075","tags":["report"]},{"url":"https://bugzilla.suse.com/1263097","tags":["report"]},{"url":"https://bugzilla.suse.com/1263111","tags":["report"]},{"url":"https://bugzilla.suse.com/1263122","tags":["report"]},{"url":"https://bugzilla.suse.com/1263123","tags":["report"]},{"url":"https://bugzilla.suse.com/1263124","tags":["report"]},{"url":"https://bugzilla.suse.com/1263128","tags":["report"]},{"url":"https://bugzilla.suse.com/1263130","tags":["report"]},{"url":"https://bugzilla.suse.com/1263134","tags":["report"]},{"url":"https://bugzilla.suse.com/1263139","tags":["report"]},{"url":"https://bugzilla.suse.com/1263142","tags":["report"]},{"url":"https://bugzilla.suse.com/1263145","tags":["report"]},{"url":"https://bugzilla.suse.com/1263152","tags":["report"]},{"url":"https://bugzilla.suse.com/1263167","tags":["report"]},{"url":"https://bugzilla.suse.com/1263170","tags":["report"]},{"url":"https://bugzilla.suse.com/1263173","tags":["report"]},{"url":"https://bugzilla.suse.com/1263175","tags":["report"]},{"url":"https://bugzilla.suse.com/1263491","tags":["report"]},{"url":"https://bugzilla.suse.com/1263493","tags":["report"]},{"url":"https://bugzilla.suse.com/1263495","tags":["report"]},{"url":"https://bugzilla.suse.com/1263539","tags":["report"]},{"url":"https://bugzilla.suse.com/1263560","tags":["report"]},{"url":"https://bugzilla.suse.com/1263588","tags":["report"]},{"url":"https://bugzilla.suse.com/1263591","tags":["report"]},{"url":"https://bugzilla.suse.com/1263598","tags":["report"]},{"url":"https://bugzilla.suse.com/1263600","tags":["report"]},{"url":"https://bugzilla.suse.com/1263657","tags":["report"]},{"url":"https://bugzilla.suse.com/1263718","tags":["report"]},{"url":"https://bugzilla.suse.com/1263723","tags":["report"]},{"url":"https://bugzilla.suse.com/1263776","tags":["report"]},{"url":"https://bugzilla.suse.com/1263777","tags":["report"]},{"url":"https://bugzilla.suse.com/1263778","tags":["report"]},{"url":"https://bugzilla.suse.com/1263780","tags":["report"]},{"url":"https://bugzilla.suse.com/1263782","tags":["report"]},{"url":"https://bugzilla.suse.com/1263785","tags":["report"]},{"url":"https://bugzilla.suse.com/1263786","tags":["report"]},{"url":"https://bugzilla.suse.com/1263788","tags":["report"]},{"url":"https://bugzilla.suse.com/1263790","tags":["report"]},{"url":"https://bugzilla.suse.com/1263797","tags":["report"]},{"url":"https://bugzilla.suse.com/1263806","tags":["report"]},{"url":"https://bugzilla.suse.com/1263876","tags":["report"]},{"url":"https://bugzilla.suse.com/1263879","tags":["report"]},{"url":"https://bugzilla.suse.com/1263880","tags":["report"]},{"url":"https://bugzilla.suse.com/1263904","tags":["report"]},{"url":"https://bugzilla.suse.com/1263905","tags":["report"]},{"url":"https://bugzilla.suse.com/1263911","tags":["report"]},{"url":"https://bugzilla.suse.com/1263917","tags":["report"]},{"url":"https://bugzilla.suse.com/1263918","tags":["report"]},{"url":"https://bugzilla.suse.com/1263919","tags":["report"]},{"url":"https://bugzilla.suse.com/1263921","tags":["report"]},{"url":"https://bugzilla.suse.com/1263923","tags":["report"]},{"url":"https://bugzilla.suse.com/1263945","tags":["report"]},{"url":"https://bugzilla.suse.com/1263975","tags":["report"]},{"url":"https://bugzilla.suse.com/1263999","tags":["report"]},{"url":"https://bugzilla.suse.com/1264003","tags":["report"]},{"url":"https://bugzilla.suse.com/1264006","tags":["report"]},{"url":"https://bugzilla.suse.com/1264008","tags":["report"]},{"url":"https://bugzilla.suse.com/1264009","tags":["report"]},{"url":"https://bugzilla.suse.com/1264013","tags":["report"]},{"url":"https://bugzilla.suse.com/1264019","tags":["report"]},{"url":"https://bugzilla.suse.com/1264030","tags":["report"]},{"url":"https://bugzilla.suse.com/1264032","tags":["report"]},{"url":"https://bugzilla.suse.com/1264033","tags":["report"]},{"url":"https://bugzilla.suse.com/1264035","tags":["report"]},{"url":"https://bugzilla.suse.com/1264039","tags":["report"]},{"url":"https://bugzilla.suse.com/1264041","tags":["report"]},{"url":"https://bugzilla.suse.com/1264044","tags":["report"]},{"url":"https://bugzilla.suse.com/1264048","tags":["report"]},{"url":"https://bugzilla.suse.com/1264053","tags":["report"]},{"url":"https://bugzilla.suse.com/1264065","tags":["report"]},{"url":"https://bugzilla.suse.com/1264070","tags":["report"]},{"url":"https://bugzilla.suse.com/1264071","tags":["report"]},{"url":"https://bugzilla.suse.com/1264073","tags":["report"]},{"url":"https://bugzilla.suse.com/1264074","tags":["report"]},{"url":"https://bugzilla.suse.com/1264075","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264079","tags":["report"]},{"url":"https://bugzilla.suse.com/1264080","tags":["report"]},{"url":"https://bugzilla.suse.com/1264084","tags":["report"]},{"url":"https://bugzilla.suse.com/1264087","tags":["report"]},{"url":"https://bugzilla.suse.com/1264088","tags":["report"]},{"url":"https://bugzilla.suse.com/1264089","tags":["report"]},{"url":"https://bugzilla.suse.com/1264090","tags":["report"]},{"url":"https://bugzilla.suse.com/1264093","tags":["report"]},{"url":"https://bugzilla.suse.com/1264100","tags":["report"]},{"url":"https://bugzilla.suse.com/1264101","tags":["report"]},{"url":"https://bugzilla.suse.com/1264110","tags":["report"]},{"url":"https://bugzilla.suse.com/1264116","tags":["report"]},{"url":"https://bugzilla.suse.com/1264117","tags":["report"]},{"url":"https://bugzilla.suse.com/1264121","tags":["report"]},{"url":"https://bugzilla.suse.com/1264122","tags":["report"]},{"url":"https://bugzilla.suse.com/1264124","tags":["report"]},{"url":"https://bugzilla.suse.com/1264125","tags":["report"]},{"url":"https://bugzilla.suse.com/1264129","tags":["report"]},{"url":"https://bugzilla.suse.com/1264137","tags":["report"]},{"url":"https://bugzilla.suse.com/1264142","tags":["report"]},{"url":"https://bugzilla.suse.com/1264184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264188","tags":["report"]},{"url":"https://bugzilla.suse.com/1264189","tags":["report"]},{"url":"https://bugzilla.suse.com/1264190","tags":["report"]},{"url":"https://bugzilla.suse.com/1264197","tags":["report"]},{"url":"https://bugzilla.suse.com/1264228","tags":["report"]},{"url":"https://bugzilla.suse.com/1264235","tags":["report"]},{"url":"https://bugzilla.suse.com/1264237","tags":["report"]},{"url":"https://bugzilla.suse.com/1264247","tags":["report"]},{"url":"https://bugzilla.suse.com/1264257","tags":["report"]},{"url":"https://bugzilla.suse.com/1264267","tags":["report"]},{"url":"https://bugzilla.suse.com/1264296","tags":["report"]},{"url":"https://bugzilla.suse.com/1264303","tags":["report"]},{"url":"https://bugzilla.suse.com/1264308","tags":["report"]},{"url":"https://bugzilla.suse.com/1264313","tags":["report"]},{"url":"https://bugzilla.suse.com/1264317","tags":["report"]},{"url":"https://bugzilla.suse.com/1264319","tags":["report"]},{"url":"https://bugzilla.suse.com/1264321","tags":["report"]},{"url":"https://bugzilla.suse.com/1264322","tags":["report"]},{"url":"https://bugzilla.suse.com/1264331","tags":["report"]},{"url":"https://bugzilla.suse.com/1264336","tags":["report"]},{"url":"https://bugzilla.suse.com/1264338","tags":["report"]},{"url":"https://bugzilla.suse.com/1264339","tags":["report"]},{"url":"https://bugzilla.suse.com/1264340","tags":["report"]},{"url":"https://bugzilla.suse.com/1264365","tags":["report"]},{"url":"https://bugzilla.suse.com/1264377","tags":["report"]},{"url":"https://bugzilla.suse.com/1264379","tags":["report"]},{"url":"https://bugzilla.suse.com/1264386","tags":["report"]},{"url":"https://bugzilla.suse.com/1264387","tags":["report"]},{"url":"https://bugzilla.suse.com/1264388","tags":["report"]},{"url":"https://bugzilla.suse.com/1264414","tags":["report"]},{"url":"https://bugzilla.suse.com/1264416","tags":["report"]},{"url":"https://bugzilla.suse.com/1264417","tags":["report"]},{"url":"https://bugzilla.suse.com/1264418","tags":["report"]},{"url":"https://bugzilla.suse.com/1264419","tags":["report"]},{"url":"https://bugzilla.suse.com/1264422","tags":["report"]},{"url":"https://bugzilla.suse.com/1264423","tags":["report"]},{"url":"https://bugzilla.suse.com/1264424","tags":["report"]},{"url":"https://bugzilla.suse.com/1264425","tags":["report"]},{"url":"https://bugzilla.suse.com/1264430","tags":["report"]},{"url":"https://bugzilla.suse.com/1264431","tags":["report"]},{"url":"https://bugzilla.suse.com/1264436","tags":["report"]},{"url":"https://bugzilla.suse.com/1264442","tags":["report"]},{"url":"https://bugzilla.suse.com/1264446","tags":["report"]},{"url":"https://bugzilla.suse.com/1264451","tags":["report"]},{"url":"https://bugzilla.suse.com/1264452","tags":["report"]},{"url":"https://bugzilla.suse.com/1264473","tags":["report"]},{"url":"https://bugzilla.suse.com/1264475","tags":["report"]},{"url":"https://bugzilla.suse.com/1264476","tags":["report"]},{"url":"https://bugzilla.suse.com/1264477","tags":["report"]},{"url":"https://bugzilla.suse.com/1264479","tags":["report"]},{"url":"https://bugzilla.suse.com/1264480","tags":["report"]},{"url":"https://bugzilla.suse.com/1264482","tags":["report"]},{"url":"https://bugzilla.suse.com/1264520","tags":["report"]},{"url":"https://bugzilla.suse.com/1264526","tags":["report"]},{"url":"https://bugzilla.suse.com/1264530","tags":["report"]},{"url":"https://bugzilla.suse.com/1264531","tags":["report"]},{"url":"https://bugzilla.suse.com/1264534","tags":["report"]},{"url":"https://bugzilla.suse.com/1264537","tags":["report"]},{"url":"https://bugzilla.suse.com/1264538","tags":["report"]},{"url":"https://bugzilla.suse.com/1264539","tags":["report"]},{"url":"https://bugzilla.suse.com/1264540","tags":["report"]},{"url":"https://bugzilla.suse.com/1264543","tags":["report"]},{"url":"https://bugzilla.suse.com/1264551","tags":["report"]},{"url":"https://bugzilla.suse.com/1264553","tags":["report"]},{"url":"https://bugzilla.suse.com/1264558","tags":["report"]},{"url":"https://bugzilla.suse.com/1264560","tags":["report"]},{"url":"https://bugzilla.suse.com/1264562","tags":["report"]},{"url":"https://bugzilla.suse.com/1264564","tags":["report"]},{"url":"https://bugzilla.suse.com/1264566","tags":["report"]},{"url":"https://bugzilla.suse.com/1264584","tags":["report"]},{"url":"https://bugzilla.suse.com/1264590","tags":["report"]},{"url":"https://bugzilla.suse.com/1264592","tags":["report"]},{"url":"https://bugzilla.suse.com/1264594","tags":["report"]},{"url":"https://bugzilla.suse.com/1264598","tags":["report"]},{"url":"https://bugzilla.suse.com/1264600","tags":["report"]},{"url":"https://bugzilla.suse.com/1264601","tags":["report"]},{"url":"https://bugzilla.suse.com/1264613","tags":["report"]},{"url":"https://bugzilla.suse.com/1264615","tags":["report"]},{"url":"https://bugzilla.suse.com/1264616","tags":["report"]},{"url":"https://bugzilla.suse.com/1264618","tags":["report"]},{"url":"https://bugzilla.suse.com/1264620","tags":["report"]},{"url":"https://bugzilla.suse.com/1264626","tags":["report"]},{"url":"https://bugzilla.suse.com/1264630","tags":["report"]},{"url":"https://bugzilla.suse.com/1264631","tags":["report"]},{"url":"https://bugzilla.suse.com/1264633","tags":["report"]},{"url":"https://bugzilla.suse.com/1264634","tags":["report"]},{"url":"https://bugzilla.suse.com/1264637","tags":["report"]},{"url":"https://bugzilla.suse.com/1264640","tags":["report"]},{"url":"https://bugzilla.suse.com/1264642","tags":["report"]},{"url":"https://bugzilla.suse.com/1264644","tags":["report"]},{"url":"https://bugzilla.suse.com/1264645","tags":["report"]},{"url":"https://bugzilla.suse.com/1264646","tags":["report"]},{"url":"https://bugzilla.suse.com/1264647","tags":["report"]},{"url":"https://bugzilla.suse.com/1264649","tags":["report"]},{"url":"https://bugzilla.suse.com/1264651","tags":["report"]},{"url":"https://bugzilla.suse.com/1264668","tags":["report"]},{"url":"https://bugzilla.suse.com/1264671","tags":["report"]},{"url":"https://bugzilla.suse.com/1264677","tags":["report"]},{"url":"https://bugzilla.suse.com/1264678","tags":["report"]},{"url":"https://bugzilla.suse.com/1264712","tags":["report"]},{"url":"https://bugzilla.suse.com/1264725","tags":["report"]},{"url":"https://bugzilla.suse.com/1264731","tags":["report"]},{"url":"https://bugzilla.suse.com/1264739","tags":["report"]},{"url":"https://bugzilla.suse.com/1264746","tags":["report"]},{"url":"https://bugzilla.suse.com/1264748","tags":["report"]},{"url":"https://bugzilla.suse.com/1264758","tags":["report"]},{"url":"https://bugzilla.suse.com/1264768","tags":["report"]},{"url":"https://bugzilla.suse.com/1264779","tags":["report"]},{"url":"https://bugzilla.suse.com/1264780","tags":["report"]},{"url":"https://bugzilla.suse.com/1264781","tags":["report"]},{"url":"https://bugzilla.suse.com/1264782","tags":["report"]},{"url":"https://bugzilla.suse.com/1264783","tags":["report"]},{"url":"https://bugzilla.suse.com/1264785","tags":["report"]},{"url":"https://bugzilla.suse.com/1264788","tags":["report"]},{"url":"https://bugzilla.suse.com/1264791","tags":["report"]},{"url":"https://bugzilla.suse.com/1264793","tags":["report"]},{"url":"https://bugzilla.suse.com/1264795","tags":["report"]},{"url":"https://bugzilla.suse.com/1264801","tags":["report"]},{"url":"https://bugzilla.suse.com/1264803","tags":["report"]},{"url":"https://bugzilla.suse.com/1264805","tags":["report"]},{"url":"https://bugzilla.suse.com/1264809","tags":["report"]},{"url":"https://bugzilla.suse.com/1264815","tags":["report"]},{"url":"https://bugzilla.suse.com/1264816","tags":["report"]},{"url":"https://bugzilla.suse.com/1264819","tags":["report"]},{"url":"https://bugzilla.suse.com/1264821","tags":["report"]},{"url":"https://bugzilla.suse.com/1264822","tags":["report"]},{"url":"https://bugzilla.suse.com/1264826","tags":["report"]},{"url":"https://bugzilla.suse.com/1264827","tags":["report"]},{"url":"https://bugzilla.suse.com/1264830","tags":["report"]},{"url":"https://bugzilla.suse.com/1264844","tags":["report"]},{"url":"https://bugzilla.suse.com/1264982","tags":["report"]},{"url":"https://bugzilla.suse.com/1264987","tags":["report"]},{"url":"https://bugzilla.suse.com/1264988","tags":["report"]},{"url":"https://bugzilla.suse.com/1264991","tags":["report"]},{"url":"https://bugzilla.suse.com/1264993","tags":["report"]},{"url":"https://bugzilla.suse.com/1265009","tags":["report"]},{"url":"https://bugzilla.suse.com/1265019","tags":["report"]},{"url":"https://bugzilla.suse.com/1265032","tags":["report"]},{"url":"https://bugzilla.suse.com/1265035","tags":["report"]},{"url":"https://bugzilla.suse.com/1265037","tags":["report"]},{"url":"https://bugzilla.suse.com/1265041","tags":["report"]},{"url":"https://bugzilla.suse.com/1265046","tags":["report"]},{"url":"https://bugzilla.suse.com/1265047","tags":["report"]},{"url":"https://bugzilla.suse.com/1265054","tags":["report"]},{"url":"https://bugzilla.suse.com/1265058","tags":["report"]},{"url":"https://bugzilla.suse.com/1265074","tags":["report"]},{"url":"https://bugzilla.suse.com/1265078","tags":["report"]},{"url":"https://bugzilla.suse.com/1265080","tags":["report"]},{"url":"https://bugzilla.suse.com/1265086","tags":["report"]},{"url":"https://bugzilla.suse.com/1265089","tags":["report"]},{"url":"https://bugzilla.suse.com/1265090","tags":["report"]},{"url":"https://bugzilla.suse.com/1265092","tags":["report"]},{"url":"https://bugzilla.suse.com/1265093","tags":["report"]},{"url":"https://bugzilla.suse.com/1265096","tags":["report"]},{"url":"https://bugzilla.suse.com/1265100","tags":["report"]},{"url":"https://bugzilla.suse.com/1265101","tags":["report"]},{"url":"https://bugzilla.suse.com/1265102","tags":["report"]},{"url":"https://bugzilla.suse.com/1265105","tags":["report"]},{"url":"https://bugzilla.suse.com/1265122","tags":["report"]},{"url":"https://bugzilla.suse.com/1265126","tags":["report"]},{"url":"https://bugzilla.suse.com/1265133","tags":["report"]},{"url":"https://bugzilla.suse.com/1265138","tags":["report"]},{"url":"https://bugzilla.suse.com/1265144","tags":["report"]},{"url":"https://bugzilla.suse.com/1265240","tags":["report"]},{"url":"https://bugzilla.suse.com/1265247","tags":["report"]},{"url":"https://bugzilla.suse.com/1265249","tags":["report"]},{"url":"https://bugzilla.suse.com/1265251","tags":["report"]},{"url":"https://bugzilla.suse.com/1265254","tags":["report"]},{"url":"https://bugzilla.suse.com/1265257","tags":["report"]},{"url":"https://bugzilla.suse.com/1265264","tags":["report"]},{"url":"https://bugzilla.suse.com/1265449","tags":["report"]},{"url":"https://bugzilla.suse.com/1265627","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1265999","tags":["report"]},{"url":"https://bugzilla.suse.com/1266000","tags":["report"]},{"url":"https://bugzilla.suse.com/1266009","tags":["report"]},{"url":"https://bugzilla.suse.com/1266393","tags":["report"]},{"url":"https://bugzilla.suse.com/1266399","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266411","tags":["report"]},{"url":"https://bugzilla.suse.com/1266412","tags":["report"]},{"url":"https://bugzilla.suse.com/1266467","tags":["report"]},{"url":"https://bugzilla.suse.com/1266468","tags":["report"]},{"url":"https://bugzilla.suse.com/1266470","tags":["report"]},{"url":"https://bugzilla.suse.com/1266677","tags":["report"]},{"url":"https://bugzilla.suse.com/1266679","tags":["report"]},{"url":"https://bugzilla.suse.com/1266684","tags":["report"]},{"url":"https://bugzilla.suse.com/1266685","tags":["report"]},{"url":"https://bugzilla.suse.com/1266688","tags":["report"]},{"url":"https://bugzilla.suse.com/1266690","tags":["report"]},{"url":"https://bugzilla.suse.com/1266692","tags":["report"]},{"url":"https://bugzilla.suse.com/1266694","tags":["report"]},{"url":"https://bugzilla.suse.com/1266695","tags":["report"]},{"url":"https://bugzilla.suse.com/1266703","tags":["report"]},{"url":"https://bugzilla.suse.com/1266706","tags":["report"]},{"url":"https://bugzilla.suse.com/1266707","tags":["report"]},{"url":"https://bugzilla.suse.com/1266712","tags":["report"]},{"url":"https://bugzilla.suse.com/1266714","tags":["report"]},{"url":"https://bugzilla.suse.com/1266715","tags":["report"]},{"url":"https://bugzilla.suse.com/1266716","tags":["report"]},{"url":"https://bugzilla.suse.com/1266721","tags":["report"]},{"url":"https://bugzilla.suse.com/1266729","tags":["report"]},{"url":"https://bugzilla.suse.com/1266730","tags":["report"]},{"url":"https://bugzilla.suse.com/1266732","tags":["report"]},{"url":"https://bugzilla.suse.com/1266735","tags":["report"]},{"url":"https://bugzilla.suse.com/1266736","tags":["report"]},{"url":"https://bugzilla.suse.com/1266739","tags":["report"]},{"url":"https://bugzilla.suse.com/1266741","tags":["report"]},{"url":"https://bugzilla.suse.com/1266743","tags":["report"]},{"url":"https://bugzilla.suse.com/1266744","tags":["report"]},{"url":"https://bugzilla.suse.com/1266751","tags":["report"]},{"url":"https://bugzilla.suse.com/1266755","tags":["report"]},{"url":"https://bugzilla.suse.com/1266757","tags":["report"]},{"url":"https://bugzilla.suse.com/1266758","tags":["report"]},{"url":"https://bugzilla.suse.com/1266762","tags":["report"]},{"url":"https://bugzilla.suse.com/1266767","tags":["report"]},{"url":"https://bugzilla.suse.com/1266774","tags":["report"]},{"url":"https://bugzilla.suse.com/1266775","tags":["report"]},{"url":"https://bugzilla.suse.com/1266780","tags":["report"]},{"url":"https://bugzilla.suse.com/1266806","tags":["report"]},{"url":"https://bugzilla.suse.com/1266813","tags":["report"]},{"url":"https://bugzilla.suse.com/1266831","tags":["report"]},{"url":"https://bugzilla.suse.com/1266832","tags":["report"]},{"url":"https://bugzilla.suse.com/1266834","tags":["report"]},{"url":"https://bugzilla.suse.com/1266835","tags":["report"]},{"url":"https://bugzilla.suse.com/1266836","tags":["report"]},{"url":"https://bugzilla.suse.com/1266839","tags":["report"]},{"url":"https://bugzilla.suse.com/1266841","tags":["report"]},{"url":"https://bugzilla.suse.com/1266842","tags":["report"]},{"url":"https://bugzilla.suse.com/1266846","tags":["report"]},{"url":"https://bugzilla.suse.com/1266850","tags":["report"]},{"url":"https://bugzilla.suse.com/1266854","tags":["report"]},{"url":"https://bugzilla.suse.com/1266855","tags":["report"]},{"url":"https://bugzilla.suse.com/1266858","tags":["report"]},{"url":"https://bugzilla.suse.com/1266863","tags":["report"]},{"url":"https://bugzilla.suse.com/1266864","tags":["report"]},{"url":"https://bugzilla.suse.com/1266869","tags":["report"]},{"url":"https://bugzilla.suse.com/1266870","tags":["report"]},{"url":"https://bugzilla.suse.com/1266872","tags":["report"]},{"url":"https://bugzilla.suse.com/1266876","tags":["report"]},{"url":"https://bugzilla.suse.com/1266879","tags":["report"]},{"url":"https://bugzilla.suse.com/1266880","tags":["report"]},{"url":"https://bugzilla.suse.com/1266882","tags":["report"]},{"url":"https://bugzilla.suse.com/1266886","tags":["report"]},{"url":"https://bugzilla.suse.com/1266890","tags":["report"]},{"url":"https://bugzilla.suse.com/1266891","tags":["report"]},{"url":"https://bugzilla.suse.com/1266894","tags":["report"]},{"url":"https://bugzilla.suse.com/1266896","tags":["report"]},{"url":"https://bugzilla.suse.com/1266898","tags":["report"]},{"url":"https://bugzilla.suse.com/1266900","tags":["report"]},{"url":"https://bugzilla.suse.com/1266904","tags":["report"]},{"url":"https://bugzilla.suse.com/1266908","tags":["report"]},{"url":"https://bugzilla.suse.com/1266910","tags":["report"]},{"url":"https://bugzilla.suse.com/1266913","tags":["report"]},{"url":"https://bugzilla.suse.com/1266917","tags":["report"]},{"url":"https://bugzilla.suse.com/1266918","tags":["report"]},{"url":"https://bugzilla.suse.com/1266920","tags":["report"]},{"url":"https://bugzilla.suse.com/1266930","tags":["report"]},{"url":"https://bugzilla.suse.com/1266931","tags":["report"]},{"url":"https://bugzilla.suse.com/1266932","tags":["report"]},{"url":"https://bugzilla.suse.com/1266934","tags":["report"]},{"url":"https://bugzilla.suse.com/1266935","tags":["report"]},{"url":"https://bugzilla.suse.com/1266939","tags":["report"]},{"url":"https://bugzilla.suse.com/1266947","tags":["report"]},{"url":"https://bugzilla.suse.com/1266969","tags":["report"]},{"url":"https://bugzilla.suse.com/1267021","tags":["report"]},{"url":"https://bugzilla.suse.com/1267025","tags":["report"]},{"url":"https://bugzilla.suse.com/1267027","tags":["report"]},{"url":"https://bugzilla.suse.com/1267198","tags":["report"]},{"url":"https://bugzilla.suse.com/1267203","tags":["report"]},{"url":"https://bugzilla.suse.com/1267204","tags":["report"]},{"url":"https://bugzilla.suse.com/1267209","tags":["report"]},{"url":"https://bugzilla.suse.com/1267210","tags":["report"]},{"url":"https://bugzilla.suse.com/1267213","tags":["report"]},{"url":"https://bugzilla.suse.com/1267222","tags":["report"]},{"url":"https://bugzilla.suse.com/1267226","tags":["report"]},{"url":"https://bugzilla.suse.com/1267234","tags":["report"]},{"url":"https://bugzilla.suse.com/1267236","tags":["report"]},{"url":"https://bugzilla.suse.com/1267251","tags":["report"]},{"url":"https://bugzilla.suse.com/1267367","tags":["report"]},{"url":"https://bugzilla.suse.com/1267371","tags":["report"]},{"url":"https://bugzilla.suse.com/1267375","tags":["report"]},{"url":"https://bugzilla.suse.com/1267380","tags":["report"]},{"url":"https://bugzilla.suse.com/1267381","tags":["report"]},{"url":"https://bugzilla.suse.com/1267384","tags":["report"]},{"url":"https://bugzilla.suse.com/1267419","tags":["report"]},{"url":"https://bugzilla.suse.com/1267432","tags":["report"]},{"url":"https://bugzilla.suse.com/1267435","tags":["report"]},{"url":"https://bugzilla.suse.com/1267436","tags":["report"]},{"url":"https://bugzilla.suse.com/1267439","tags":["report"]},{"url":"https://bugzilla.suse.com/1267445","tags":["report"]},{"url":"https://bugzilla.suse.com/1267448","tags":["report"]},{"url":"https://bugzilla.suse.com/1267449","tags":["report"]},{"url":"https://bugzilla.suse.com/1267466","tags":["report"]},{"url":"https://bugzilla.suse.com/1267468","tags":["report"]},{"url":"https://bugzilla.suse.com/1267470","tags":["report"]},{"url":"https://bugzilla.suse.com/1267472","tags":["report"]},{"url":"https://bugzilla.suse.com/1267473","tags":["report"]},{"url":"https://bugzilla.suse.com/1267479","tags":["report"]},{"url":"https://bugzilla.suse.com/1267491","tags":["report"]},{"url":"https://bugzilla.suse.com/1267495","tags":["report"]},{"url":"https://bugzilla.suse.com/1267496","tags":["report"]},{"url":"https://bugzilla.suse.com/1267497","tags":["report"]},{"url":"https://bugzilla.suse.com/1267502","tags":["report"]},{"url":"https://bugzilla.suse.com/1267524","tags":["report"]},{"url":"https://bugzilla.suse.com/1267555","tags":["report"]},{"url":"https://bugzilla.suse.com/1267565","tags":["report"]},{"url":"https://bugzilla.suse.com/1267567","tags":["report"]},{"url":"https://bugzilla.suse.com/1267570","tags":["report"]},{"url":"https://bugzilla.suse.com/1267571","tags":["report"]},{"url":"https://bugzilla.suse.com/1267583","tags":["report"]},{"url":"https://bugzilla.suse.com/1267584","tags":["report"]},{"url":"https://bugzilla.suse.com/1267592","tags":["report"]},{"url":"https://bugzilla.suse.com/1267594","tags":["report"]},{"url":"https://bugzilla.suse.com/1267595","tags":["report"]},{"url":"https://bugzilla.suse.com/1267596","tags":["report"]},{"url":"https://bugzilla.suse.com/1267597","tags":["report"]},{"url":"https://bugzilla.suse.com/1267600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267611","tags":["report"]},{"url":"https://bugzilla.suse.com/1267615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267616","tags":["report"]},{"url":"https://bugzilla.suse.com/1267621","tags":["report"]},{"url":"https://bugzilla.suse.com/1267623","tags":["report"]},{"url":"https://bugzilla.suse.com/1267627","tags":["report"]},{"url":"https://bugzilla.suse.com/1267629","tags":["report"]},{"url":"https://bugzilla.suse.com/1267630","tags":["report"]},{"url":"https://bugzilla.suse.com/1267632","tags":["report"]},{"url":"https://bugzilla.suse.com/1267636","tags":["report"]},{"url":"https://bugzilla.suse.com/1267638","tags":["report"]},{"url":"https://bugzilla.suse.com/1267643","tags":["report"]},{"url":"https://bugzilla.suse.com/1267646","tags":["report"]},{"url":"https://bugzilla.suse.com/1267648","tags":["report"]},{"url":"https://bugzilla.suse.com/1267649","tags":["report"]},{"url":"https://bugzilla.suse.com/1267651","tags":["report"]},{"url":"https://bugzilla.suse.com/1267656","tags":["report"]},{"url":"https://bugzilla.suse.com/1267657","tags":["report"]},{"url":"https://bugzilla.suse.com/1267658","tags":["report"]},{"url":"https://bugzilla.suse.com/1267659","tags":["report"]},{"url":"https://bugzilla.suse.com/1267661","tags":["report"]},{"url":"https://bugzilla.suse.com/1267662","tags":["report"]},{"url":"https://bugzilla.suse.com/1267663","tags":["report"]},{"url":"https://bugzilla.suse.com/1267666","tags":["report"]},{"url":"https://bugzilla.suse.com/1267667","tags":["report"]},{"url":"https://bugzilla.suse.com/1267669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267673","tags":["report"]},{"url":"https://bugzilla.suse.com/1267676","tags":["report"]},{"url":"https://bugzilla.suse.com/1267677","tags":["report"]},{"url":"https://bugzilla.suse.com/1267678","tags":["report"]},{"url":"https://bugzilla.suse.com/1267680","tags":["report"]},{"url":"https://bugzilla.suse.com/1267682","tags":["report"]},{"url":"https://bugzilla.suse.com/1267683","tags":["report"]},{"url":"https://bugzilla.suse.com/1267689","tags":["report"]},{"url":"https://bugzilla.suse.com/1267690","tags":["report"]},{"url":"https://bugzilla.suse.com/1267691","tags":["report"]},{"url":"https://bugzilla.suse.com/1267693","tags":["report"]},{"url":"https://bugzilla.suse.com/1267701","tags":["report"]},{"url":"https://bugzilla.suse.com/1267702","tags":["report"]},{"url":"https://bugzilla.suse.com/1267704","tags":["report"]},{"url":"https://bugzilla.suse.com/1267712","tags":["report"]},{"url":"https://bugzilla.suse.com/1267714","tags":["report"]},{"url":"https://bugzilla.suse.com/1267715","tags":["report"]},{"url":"https://bugzilla.suse.com/1267719","tags":["report"]},{"url":"https://bugzilla.suse.com/1267725","tags":["report"]},{"url":"https://bugzilla.suse.com/1267726","tags":["report"]},{"url":"https://bugzilla.suse.com/1267728","tags":["report"]},{"url":"https://bugzilla.suse.com/1267738","tags":["report"]},{"url":"https://bugzilla.suse.com/1267918","tags":["report"]},{"url":"https://bugzilla.suse.com/1267919","tags":["report"]},{"url":"https://bugzilla.suse.com/1267922","tags":["report"]},{"url":"https://bugzilla.suse.com/1267927","tags":["report"]},{"url":"https://bugzilla.suse.com/1267932","tags":["report"]},{"url":"https://bugzilla.suse.com/1267939","tags":["report"]},{"url":"https://bugzilla.suse.com/1267943","tags":["report"]},{"url":"https://bugzilla.suse.com/1267948","tags":["report"]},{"url":"https://bugzilla.suse.com/1267952","tags":["report"]},{"url":"https://bugzilla.suse.com/1267953","tags":["report"]},{"url":"https://bugzilla.suse.com/1267954","tags":["report"]},{"url":"https://bugzilla.suse.com/1267968","tags":["report"]},{"url":"https://bugzilla.suse.com/1267983","tags":["report"]},{"url":"https://bugzilla.suse.com/1267986","tags":["report"]},{"url":"https://bugzilla.suse.com/1267987","tags":["report"]},{"url":"https://bugzilla.suse.com/1267990","tags":["report"]},{"url":"https://bugzilla.suse.com/1267991","tags":["report"]},{"url":"https://bugzilla.suse.com/1267995","tags":["report"]},{"url":"https://bugzilla.suse.com/1268024","tags":["report"]},{"url":"https://bugzilla.suse.com/1268029","tags":["report"]},{"url":"https://bugzilla.suse.com/1268030","tags":["report"]},{"url":"https://bugzilla.suse.com/1268031","tags":["report"]},{"url":"https://bugzilla.suse.com/1268038","tags":["report"]},{"url":"https://bugzilla.suse.com/1268051","tags":["report"]},{"url":"https://bugzilla.suse.com/1268220","tags":["report"]},{"url":"https://bugzilla.suse.com/1268221","tags":["report"]},{"url":"https://bugzilla.suse.com/1268222","tags":["report"]},{"url":"https://bugzilla.suse.com/1268223","tags":["report"]},{"url":"https://bugzilla.suse.com/1268307","tags":["report"]},{"url":"https://bugzilla.suse.com/1268659","tags":["report"]},{"url":"https://bugzilla.suse.com/1268966","tags":["report"]},{"url":"https://bugzilla.suse.com/1268967","tags":["report"]},{"url":"https://bugzilla.suse.com/1268981","tags":["report"]},{"url":"https://bugzilla.suse.com/1268983","tags":["report"]},{"url":"https://bugzilla.suse.com/1268985","tags":["report"]},{"url":"https://bugzilla.suse.com/1268987","tags":["report"]},{"url":"https://bugzilla.suse.com/1268994","tags":["report"]},{"url":"https://bugzilla.suse.com/1269001","tags":["report"]},{"url":"https://bugzilla.suse.com/1269002","tags":["report"]},{"url":"https://bugzilla.suse.com/1269003","tags":["report"]},{"url":"https://bugzilla.suse.com/1269024","tags":["report"]},{"url":"https://bugzilla.suse.com/1269025","tags":["report"]},{"url":"https://bugzilla.suse.com/1269027","tags":["report"]},{"url":"https://bugzilla.suse.com/1269030","tags":["report"]},{"url":"https://bugzilla.suse.com/1269081","tags":["report"]},{"url":"https://bugzilla.suse.com/1269090","tags":["report"]},{"url":"https://bugzilla.suse.com/1269092","tags":["report"]},{"url":"https://bugzilla.suse.com/1269094","tags":["report"]},{"url":"https://bugzilla.suse.com/1269095","tags":["report"]},{"url":"https://bugzilla.suse.com/1269098","tags":["report"]},{"url":"https://bugzilla.suse.com/1269100","tags":["report"]},{"url":"https://bugzilla.suse.com/1269104","tags":["report"]},{"url":"https://bugzilla.suse.com/1269106","tags":["report"]},{"url":"https://bugzilla.suse.com/1269107","tags":["report"]},{"url":"https://bugzilla.suse.com/1269111","tags":["report"]},{"url":"https://bugzilla.suse.com/1269112","tags":["report"]},{"url":"https://bugzilla.suse.com/1269115","tags":["report"]},{"url":"https://bugzilla.suse.com/1269116","tags":["report"]},{"url":"https://bugzilla.suse.com/1269117","tags":["report"]},{"url":"https://bugzilla.suse.com/1269118","tags":["report"]},{"url":"https://bugzilla.suse.com/1269119","tags":["report"]},{"url":"https://bugzilla.suse.com/1269124","tags":["report"]},{"url":"https://bugzilla.suse.com/1269125","tags":["report"]},{"url":"https://bugzilla.suse.com/1269131","tags":["report"]},{"url":"https://bugzilla.suse.com/1269132","tags":["report"]},{"url":"https://bugzilla.suse.com/1269133","tags":["report"]},{"url":"https://bugzilla.suse.com/1269138","tags":["report"]},{"url":"https://bugzilla.suse.com/1269141","tags":["report"]},{"url":"https://bugzilla.suse.com/1269153","tags":["report"]},{"url":"https://bugzilla.suse.com/1269154","tags":["report"]},{"url":"https://bugzilla.suse.com/1269157","tags":["report"]},{"url":"https://bugzilla.suse.com/1269158","tags":["report"]},{"url":"https://bugzilla.suse.com/1269166","tags":["report"]},{"url":"https://bugzilla.suse.com/1269170","tags":["report"]},{"url":"https://bugzilla.suse.com/1269172","tags":["report"]},{"url":"https://bugzilla.suse.com/1269174","tags":["report"]},{"url":"https://bugzilla.suse.com/1269175","tags":["report"]},{"url":"https://bugzilla.suse.com/1269177","tags":["report"]},{"url":"https://bugzilla.suse.com/1269178","tags":["report"]},{"url":"https://bugzilla.suse.com/1269181","tags":["report"]},{"url":"https://bugzilla.suse.com/1269184","tags":["report"]},{"url":"https://bugzilla.suse.com/1269185","tags":["report"]},{"url":"https://bugzilla.suse.com/1269186","tags":["report"]},{"url":"https://bugzilla.suse.com/1269187","tags":["report"]},{"url":"https://bugzilla.suse.com/1269190","tags":["report"]},{"url":"https://bugzilla.suse.com/1269195","tags":["report"]},{"url":"https://bugzilla.suse.com/1269198","tags":["report"]},{"url":"https://bugzilla.suse.com/1269227","tags":["report"]},{"url":"https://bugzilla.suse.com/1269229","tags":["report"]},{"url":"https://bugzilla.suse.com/1269232","tags":["report"]},{"url":"https://bugzilla.suse.com/1269233","tags":["report"]},{"url":"https://bugzilla.suse.com/1269235","tags":["report"]},{"url":"https://bugzilla.suse.com/1269236","tags":["report"]},{"url":"https://bugzilla.suse.com/1269239","tags":["report"]},{"url":"https://bugzilla.suse.com/1269240","tags":["report"]},{"url":"https://bugzilla.suse.com/1269241","tags":["report"]},{"url":"https://bugzilla.suse.com/1269244","tags":["report"]},{"url":"https://bugzilla.suse.com/1269245","tags":["report"]},{"url":"https://bugzilla.suse.com/1269254","tags":["report"]},{"url":"https://bugzilla.suse.com/1269255","tags":["report"]},{"url":"https://bugzilla.suse.com/1269257","tags":["report"]},{"url":"https://bugzilla.suse.com/1269258","tags":["report"]},{"url":"https://bugzilla.suse.com/1269270","tags":["report"]},{"url":"https://bugzilla.suse.com/1269272","tags":["report"]},{"url":"https://bugzilla.suse.com/1269273","tags":["report"]},{"url":"https://bugzilla.suse.com/1269281","tags":["report"]},{"url":"https://bugzilla.suse.com/1269283","tags":["report"]},{"url":"https://bugzilla.suse.com/1269286","tags":["report"]},{"url":"https://bugzilla.suse.com/1269289","tags":["report"]},{"url":"https://bugzilla.suse.com/1269290","tags":["report"]},{"url":"https://bugzilla.suse.com/1269304","tags":["report"]},{"url":"https://bugzilla.suse.com/1269307","tags":["report"]},{"url":"https://bugzilla.suse.com/1269314","tags":["report"]},{"url":"https://bugzilla.suse.com/1269318","tags":["report"]},{"url":"https://bugzilla.suse.com/1269337","tags":["report"]},{"url":"https://bugzilla.suse.com/1269362","tags":["report"]},{"url":"https://bugzilla.suse.com/1269364","tags":["report"]},{"url":"https://bugzilla.suse.com/1269376","tags":["report"]},{"url":"https://bugzilla.suse.com/1269378","tags":["report"]},{"url":"https://bugzilla.suse.com/1269383","tags":["report"]},{"url":"https://bugzilla.suse.com/1269385","tags":["report"]},{"url":"https://bugzilla.suse.com/1269386","tags":["report"]},{"url":"https://bugzilla.suse.com/1269391","tags":["report"]},{"url":"https://bugzilla.suse.com/1269403","tags":["report"]},{"url":"https://bugzilla.suse.com/1269404","tags":["report"]},{"url":"https://bugzilla.suse.com/1269410","tags":["report"]},{"url":"https://bugzilla.suse.com/1269414","tags":["report"]},{"url":"https://bugzilla.suse.com/1269415","tags":["report"]},{"url":"https://bugzilla.suse.com/1269505","tags":["report"]},{"url":"https://bugzilla.suse.com/1269511","tags":["report"]},{"url":"https://bugzilla.suse.com/1269512","tags":["report"]},{"url":"https://bugzilla.suse.com/1269513","tags":["report"]},{"url":"https://bugzilla.suse.com/1269556","tags":["report"]},{"url":"https://bugzilla.suse.com/1269557","tags":["report"]},{"url":"https://bugzilla.suse.com/1269574","tags":["report"]},{"url":"https://bugzilla.suse.com/1269577","tags":["report"]},{"url":"https://bugzilla.suse.com/1269588","tags":["report"]},{"url":"https://bugzilla.suse.com/1269637","tags":["report"]},{"url":"https://bugzilla.suse.com/1269643","tags":["report"]},{"url":"https://bugzilla.suse.com/1269644","tags":["report"]},{"url":"https://bugzilla.suse.com/1269652","tags":["report"]},{"url":"https://bugzilla.suse.com/1269654","tags":["report"]},{"url":"https://bugzilla.suse.com/1269658","tags":["report"]},{"url":"https://bugzilla.suse.com/1269659","tags":["report"]},{"url":"https://bugzilla.suse.com/1269660","tags":["report"]},{"url":"https://bugzilla.suse.com/1269661","tags":["report"]},{"url":"https://bugzilla.suse.com/1269663","tags":["report"]},{"url":"https://bugzilla.suse.com/1269669","tags":["report"]},{"url":"https://bugzilla.suse.com/1269670","tags":["report"]},{"url":"https://bugzilla.suse.com/1269672","tags":["report"]},{"url":"https://bugzilla.suse.com/1269674","tags":["report"]},{"url":"https://bugzilla.suse.com/1269675","tags":["report"]},{"url":"https://bugzilla.suse.com/1269677","tags":["report"]},{"url":"https://bugzilla.suse.com/1269678","tags":["report"]},{"url":"https://bugzilla.suse.com/1269681","tags":["report"]},{"url":"https://bugzilla.suse.com/1269682","tags":["report"]},{"url":"https://bugzilla.suse.com/1269684","tags":["report"]},{"url":"https://bugzilla.suse.com/1269687","tags":["report"]},{"url":"https://bugzilla.suse.com/1269688","tags":["report"]},{"url":"https://bugzilla.suse.com/1269689","tags":["report"]},{"url":"https://bugzilla.suse.com/1269694","tags":["report"]},{"url":"https://bugzilla.suse.com/1269709","tags":["report"]},{"url":"https://bugzilla.suse.com/1269711","tags":["report"]},{"url":"https://bugzilla.suse.com/1269712","tags":["report"]},{"url":"https://bugzilla.suse.com/1269713","tags":["report"]},{"url":"https://bugzilla.suse.com/1269714","tags":["report"]},{"url":"https://bugzilla.suse.com/1269719","tags":["report"]},{"url":"https://bugzilla.suse.com/1269722","tags":["report"]},{"url":"https://bugzilla.suse.com/1269724","tags":["report"]},{"url":"https://bugzilla.suse.com/1269726","tags":["report"]},{"url":"https://bugzilla.suse.com/1269727","tags":["report"]},{"url":"https://bugzilla.suse.com/1269731","tags":["report"]},{"url":"https://bugzilla.suse.com/1269733","tags":["report"]},{"url":"https://bugzilla.suse.com/1269734","tags":["report"]},{"url":"https://bugzilla.suse.com/1269770","tags":["report"]},{"url":"https://bugzilla.suse.com/1269772","tags":["report"]},{"url":"https://bugzilla.suse.com/1269773","tags":["report"]},{"url":"https://bugzilla.suse.com/1269786","tags":["report"]},{"url":"https://bugzilla.suse.com/1269796","tags":["report"]},{"url":"https://bugzilla.suse.com/1269797","tags":["report"]},{"url":"https://bugzilla.suse.com/1269799","tags":["report"]},{"url":"https://bugzilla.suse.com/1269801","tags":["report"]},{"url":"https://bugzilla.suse.com/1269808","tags":["report"]},{"url":"https://bugzilla.suse.com/1269810","tags":["report"]},{"url":"https://bugzilla.suse.com/1269811","tags":["report"]},{"url":"https://bugzilla.suse.com/1269817","tags":["report"]},{"url":"https://bugzilla.suse.com/1269819","tags":["report"]},{"url":"https://bugzilla.suse.com/1269826","tags":["report"]},{"url":"https://bugzilla.suse.com/1269877","tags":["report"]},{"url":"https://bugzilla.suse.com/1269879","tags":["report"]},{"url":"https://bugzilla.suse.com/1269884","tags":["report"]},{"url":"https://bugzilla.suse.com/1269886","tags":["report"]},{"url":"https://bugzilla.suse.com/1269889","tags":["report"]},{"url":"https://bugzilla.suse.com/1269898","tags":["report"]},{"url":"https://bugzilla.suse.com/1269899","tags":["report"]},{"url":"https://bugzilla.suse.com/1269902","tags":["report"]},{"url":"https://bugzilla.suse.com/1269950","tags":["report"]},{"url":"https://bugzilla.suse.com/1269961","tags":["report"]},{"url":"https://bugzilla.suse.com/1269964","tags":["report"]},{"url":"https://bugzilla.suse.com/1269973","tags":["report"]},{"url":"https://bugzilla.suse.com/1269976","tags":["report"]},{"url":"https://bugzilla.suse.com/1269979","tags":["report"]},{"url":"https://bugzilla.suse.com/1269984","tags":["report"]},{"url":"https://bugzilla.suse.com/1269986","tags":["report"]},{"url":"https://bugzilla.suse.com/1269988","tags":["report"]},{"url":"https://bugzilla.suse.com/1269990","tags":["report"]},{"url":"https://bugzilla.suse.com/1269991","tags":["report"]},{"url":"https://bugzilla.suse.com/1269993","tags":["report"]},{"url":"https://bugzilla.suse.com/1269994","tags":["report"]},{"url":"https://bugzilla.suse.com/1269995","tags":["report"]},{"url":"https://bugzilla.suse.com/1269996","tags":["report"]},{"url":"https://bugzilla.suse.com/1269997","tags":["report"]},{"url":"https://bugzilla.suse.com/1269998","tags":["report"]},{"url":"https://bugzilla.suse.com/1270058","tags":["report"]},{"url":"https://bugzilla.suse.com/1270059","tags":["report"]},{"url":"https://bugzilla.suse.com/1270102","tags":["report"]},{"url":"https://bugzilla.suse.com/1270112","tags":["report"]},{"url":"https://bugzilla.suse.com/1270113","tags":["report"]},{"url":"https://bugzilla.suse.com/1270132","tags":["report"]},{"url":"https://bugzilla.suse.com/1270241","tags":["report"]},{"url":"https://bugzilla.suse.com/1270244","tags":["report"]},{"url":"https://bugzilla.suse.com/1270248","tags":["report"]},{"url":"https://bugzilla.suse.com/1270249","tags":["report"]},{"url":"https://bugzilla.suse.com/1270257","tags":["report"]},{"url":"https://bugzilla.suse.com/1270260","tags":["report"]},{"url":"https://bugzilla.suse.com/1270302","tags":["report"]},{"url":"https://bugzilla.suse.com/1271290","tags":["report"]},{"url":"https://bugzilla.suse.com/1271291","tags":["report"]},{"url":"https://bugzilla.suse.com/1271349","tags":["report"]},{"url":"https://bugzilla.suse.com/1271366","tags":["report"]},{"url":"https://bugzilla.suse.com/1271368","tags":["report"]},{"url":"https://bugzilla.suse.com/1271395","tags":["report"]},{"url":"https://bugzilla.suse.com/1271526","tags":["report"]},{"url":"https://bugzilla.suse.com/1271717","tags":["report"]},{"url":"https://bugzilla.suse.com/1271731","tags":["report"]},{"url":"https://bugzilla.suse.com/1271813","tags":["report"]},{"url":"https://bugzilla.suse.com/1271818","tags":["report"]},{"url":"https://bugzilla.suse.com/1271820","tags":["report"]},{"url":"https://bugzilla.suse.com/1271825","tags":["report"]},{"url":"https://bugzilla.suse.com/1271826","tags":["report"]},{"url":"https://bugzilla.suse.com/1271827","tags":["report"]},{"url":"https://bugzilla.suse.com/1271830","tags":["report"]},{"url":"https://bugzilla.suse.com/1271831","tags":["report"]},{"url":"https://bugzilla.suse.com/1271832","tags":["report"]},{"url":"https://bugzilla.suse.com/1271833","tags":["report"]},{"url":"https://bugzilla.suse.com/1271834","tags":["report"]},{"url":"https://bugzilla.suse.com/1271835","tags":["report"]},{"url":"https://bugzilla.suse.com/1271858","tags":["report"]},{"url":"https://bugzilla.suse.com/1271859","tags":["report"]},{"url":"https://bugzilla.suse.com/1271866","tags":["report"]},{"url":"https://bugzilla.suse.com/1271869","tags":["report"]},{"url":"https://bugzilla.suse.com/1271870","tags":["report"]},{"url":"https://bugzilla.suse.com/1271899","tags":["report"]},{"url":"https://bugzilla.suse.com/1271904","tags":["report"]},{"url":"https://bugzilla.suse.com/1271906","tags":["report"]},{"url":"https://bugzilla.suse.com/1271908","tags":["report"]},{"url":"https://bugzilla.suse.com/1271912","tags":["report"]},{"url":"https://bugzilla.suse.com/1271937","tags":["report"]},{"url":"https://bugzilla.suse.com/1271955","tags":["report"]},{"url":"https://bugzilla.suse.com/1271964","tags":["report"]},{"url":"https://bugzilla.suse.com/1271967","tags":["report"]},{"url":"https://bugzilla.suse.com/1272146","tags":["report"]},{"url":"https://bugzilla.suse.com/1272150","tags":["report"]},{"url":"https://bugzilla.suse.com/1272176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272179","tags":["report"]},{"url":"https://bugzilla.suse.com/1272180","tags":["report"]},{"url":"https://bugzilla.suse.com/1272183","tags":["report"]},{"url":"https://bugzilla.suse.com/1272184","tags":["report"]},{"url":"https://bugzilla.suse.com/1272187","tags":["report"]},{"url":"https://bugzilla.suse.com/1272194","tags":["report"]},{"url":"https://bugzilla.suse.com/1272197","tags":["report"]},{"url":"https://bugzilla.suse.com/1272204","tags":["report"]},{"url":"https://bugzilla.suse.com/1272207","tags":["report"]},{"url":"https://bugzilla.suse.com/1272211","tags":["report"]},{"url":"https://bugzilla.suse.com/1272242","tags":["report"]},{"url":"https://bugzilla.suse.com/1272246","tags":["report"]},{"url":"https://bugzilla.suse.com/1272263","tags":["report"]},{"url":"https://bugzilla.suse.com/1272268","tags":["report"]},{"url":"https://bugzilla.suse.com/1272282","tags":["report"]},{"url":"https://bugzilla.suse.com/1272296","tags":["report"]},{"url":"https://bugzilla.suse.com/1272359","tags":["report"]},{"url":"https://bugzilla.suse.com/1272360","tags":["report"]},{"url":"https://bugzilla.suse.com/1272361","tags":["report"]},{"url":"https://bugzilla.suse.com/1272362","tags":["report"]},{"url":"https://bugzilla.suse.com/1272373","tags":["report"]},{"url":"https://bugzilla.suse.com/1272374","tags":["report"]},{"url":"https://bugzilla.suse.com/1272380","tags":["report"]},{"url":"https://bugzilla.suse.com/1272381","tags":["report"]},{"url":"https://bugzilla.suse.com/1272383","tags":["report"]},{"url":"https://bugzilla.suse.com/1272384","tags":["report"]},{"url":"https://bugzilla.suse.com/1272387","tags":["report"]},{"url":"https://bugzilla.suse.com/1272389","tags":["report"]},{"url":"https://bugzilla.suse.com/1272406","tags":["report"]},{"url":"https://bugzilla.suse.com/1272422","tags":["report"]},{"url":"https://bugzilla.suse.com/1272434","tags":["report"]},{"url":"https://bugzilla.suse.com/1272462","tags":["report"]},{"url":"https://bugzilla.suse.com/1272466","tags":["report"]},{"url":"https://bugzilla.suse.com/1272467","tags":["report"]},{"url":"https://bugzilla.suse.com/1272468","tags":["report"]},{"url":"https://bugzilla.suse.com/1272470","tags":["report"]},{"url":"https://bugzilla.suse.com/1272471","tags":["report"]},{"url":"https://bugzilla.suse.com/1272472","tags":["report"]},{"url":"https://bugzilla.suse.com/1272474","tags":["report"]},{"url":"https://bugzilla.suse.com/1272478","tags":["report"]},{"url":"https://bugzilla.suse.com/1272480","tags":["report"]},{"url":"https://bugzilla.suse.com/1272482","tags":["report"]},{"url":"https://bugzilla.suse.com/1272483","tags":["report"]},{"url":"https://bugzilla.suse.com/1272489","tags":["report"]},{"url":"https://bugzilla.suse.com/1272492","tags":["report"]},{"url":"https://bugzilla.suse.com/1272494","tags":["report"]},{"url":"https://bugzilla.suse.com/1272499","tags":["report"]},{"url":"https://bugzilla.suse.com/1272500","tags":["report"]},{"url":"https://bugzilla.suse.com/1272504","tags":["report"]},{"url":"https://bugzilla.suse.com/1272505","tags":["report"]},{"url":"https://bugzilla.suse.com/1272514","tags":["report"]},{"url":"https://bugzilla.suse.com/1272517","tags":["report"]},{"url":"https://bugzilla.suse.com/1272522","tags":["report"]},{"url":"https://bugzilla.suse.com/1272523","tags":["report"]},{"url":"https://bugzilla.suse.com/1272524","tags":["report"]},{"url":"https://bugzilla.suse.com/1272568","tags":["report"]},{"url":"https://bugzilla.suse.com/1272572","tags":["report"]},{"url":"https://bugzilla.suse.com/1272573","tags":["report"]},{"url":"https://bugzilla.suse.com/1272578","tags":["report"]},{"url":"https://bugzilla.suse.com/1272591","tags":["report"]},{"url":"https://bugzilla.suse.com/1272607","tags":["report"]},{"url":"https://bugzilla.suse.com/1272610","tags":["report"]},{"url":"https://bugzilla.suse.com/1272612","tags":["report"]},{"url":"https://bugzilla.suse.com/1272613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272614","tags":["report"]},{"url":"https://bugzilla.suse.com/1272617","tags":["report"]},{"url":"https://bugzilla.suse.com/1272618","tags":["report"]},{"url":"https://bugzilla.suse.com/1272620","tags":["report"]},{"url":"https://bugzilla.suse.com/1272642","tags":["report"]},{"url":"https://bugzilla.suse.com/1272646","tags":["report"]},{"url":"https://bugzilla.suse.com/1272659","tags":["report"]},{"url":"https://bugzilla.suse.com/1272662","tags":["report"]},{"url":"https://bugzilla.suse.com/1272664","tags":["report"]},{"url":"https://bugzilla.suse.com/1272665","tags":["report"]},{"url":"https://bugzilla.suse.com/1272668","tags":["report"]},{"url":"https://bugzilla.suse.com/1272670","tags":["report"]},{"url":"https://bugzilla.suse.com/1272671","tags":["report"]},{"url":"https://bugzilla.suse.com/1272675","tags":["report"]},{"url":"https://bugzilla.suse.com/1272678","tags":["report"]},{"url":"https://bugzilla.suse.com/1272680","tags":["report"]},{"url":"https://bugzilla.suse.com/1272681","tags":["report"]},{"url":"https://bugzilla.suse.com/1272682","tags":["report"]},{"url":"https://bugzilla.suse.com/1272685","tags":["report"]},{"url":"https://bugzilla.suse.com/1272686","tags":["report"]},{"url":"https://bugzilla.suse.com/1272689","tags":["report"]},{"url":"https://bugzilla.suse.com/1272690","tags":["report"]},{"url":"https://bugzilla.suse.com/1272691","tags":["report"]},{"url":"https://bugzilla.suse.com/1272693","tags":["report"]},{"url":"https://bugzilla.suse.com/1272694","tags":["report"]},{"url":"https://bugzilla.suse.com/1272706","tags":["report"]},{"url":"https://bugzilla.suse.com/1272781","tags":["report"]},{"url":"https://bugzilla.suse.com/1272785","tags":["report"]},{"url":"https://bugzilla.suse.com/1272787","tags":["report"]},{"url":"https://bugzilla.suse.com/1272797","tags":["report"]},{"url":"https://bugzilla.suse.com/1272800","tags":["report"]},{"url":"https://bugzilla.suse.com/1272807","tags":["report"]},{"url":"https://bugzilla.suse.com/1272836","tags":["report"]},{"url":"https://bugzilla.suse.com/1272843","tags":["report"]},{"url":"https://bugzilla.suse.com/1272847","tags":["report"]},{"url":"https://bugzilla.suse.com/1272848","tags":["report"]},{"url":"https://bugzilla.suse.com/1272850","tags":["report"]},{"url":"https://bugzilla.suse.com/1272853","tags":["report"]},{"url":"https://bugzilla.suse.com/1272858","tags":["report"]},{"url":"https://bugzilla.suse.com/1272863","tags":["report"]},{"url":"https://bugzilla.suse.com/1272867","tags":["report"]},{"url":"https://bugzilla.suse.com/1272871","tags":["report"]},{"url":"https://bugzilla.suse.com/1272891","tags":["report"]},{"url":"https://bugzilla.suse.com/1272892","tags":["report"]},{"url":"https://bugzilla.suse.com/1272897","tags":["report"]},{"url":"https://bugzilla.suse.com/1272903","tags":["report"]},{"url":"https://bugzilla.suse.com/1272907","tags":["report"]},{"url":"https://bugzilla.suse.com/1272920","tags":["report"]},{"url":"https://bugzilla.suse.com/1272973","tags":["report"]},{"url":"https://bugzilla.suse.com/1272993","tags":["report"]},{"url":"https://bugzilla.suse.com/1273005","tags":["report"]},{"url":"https://bugzilla.suse.com/1273023","tags":["report"]},{"url":"https://bugzilla.suse.com/1273035","tags":["report"]},{"url":"https://bugzilla.suse.com/1273044","tags":["report"]},{"url":"https://bugzilla.suse.com/1273053","tags":["report"]},{"url":"https://bugzilla.suse.com/1273054","tags":["report"]},{"url":"https://bugzilla.suse.com/1273117","tags":["report"]},{"url":"https://bugzilla.suse.com/1273231","tags":["report"]},{"url":"https://bugzilla.suse.com/1274072","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623193-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239511","tags":["report"]},{"url":"https://bugzilla.suse.com/1253674","tags":["report"]},{"url":"https://bugzilla.suse.com/1255357","tags":["report"]},{"url":"https://bugzilla.suse.com/1255703","tags":["report"]},{"url":"https://bugzilla.suse.com/1256675","tags":["report"]},{"url":"https://bugzilla.suse.com/1257815","tags":["report"]},{"url":"https://bugzilla.suse.com/1262649","tags":["report"]},{"url":"https://bugzilla.suse.com/1263068","tags":["report"]},{"url":"https://bugzilla.suse.com/1263562","tags":["report"]},{"url":"https://bugzilla.suse.com/1264007","tags":["report"]},{"url":"https://bugzilla.suse.com/1264315","tags":["report"]},{"url":"https://bugzilla.suse.com/1264333","tags":["report"]},{"url":"https://bugzilla.suse.com/1264532","tags":["report"]},{"url":"https://bugzilla.suse.com/1264832","tags":["report"]},{"url":"https://bugzilla.suse.com/1265141","tags":["report"]},{"url":"https://bugzilla.suse.com/1265308","tags":["report"]},{"url":"https://bugzilla.suse.com/1266003","tags":["report"]},{"url":"https://bugzilla.suse.com/1266238","tags":["report"]},{"url":"https://bugzilla.suse.com/1266290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266710","tags":["report"]},{"url":"https://bugzilla.suse.com/1266777","tags":["report"]},{"url":"https://bugzilla.suse.com/1266884","tags":["report"]},{"url":"https://bugzilla.suse.com/1268986","tags":["report"]},{"url":"https://bugzilla.suse.com/1269008","tags":["report"]},{"url":"https://bugzilla.suse.com/1269031","tags":["report"]},{"url":"https://bugzilla.suse.com/1269134","tags":["report"]},{"url":"https://bugzilla.suse.com/1269633","tags":["report"]},{"url":"https://bugzilla.suse.com/1269697","tags":["report"]},{"url":"https://bugzilla.suse.com/1269904","tags":["report"]},{"url":"https://bugzilla.suse.com/1269981","tags":["report"]},{"url":"https://bugzilla.suse.com/1270000","tags":["report"]},{"url":"https://bugzilla.suse.com/1270230","tags":["report"]},{"url":"https://bugzilla.suse.com/1272149","tags":["report"]},{"url":"https://bugzilla.suse.com/1272501","tags":["report"]},{"url":"https://bugzilla.suse.com/1272513","tags":["report"]},{"url":"https://bugzilla.suse.com/1272600","tags":["report"]},{"url":"https://bugzilla.suse.com/1272855","tags":["report"]},{"url":"https://bugzilla.suse.com/1272865","tags":["report"]},{"url":"https://bugzilla.suse.com/1272904","tags":["report"]},{"url":"https://bugzilla.suse.com/1272918","tags":["report"]},{"url":"https://bugzilla.suse.com/1273004","tags":["report"]},{"url":"https://bugzilla.suse.com/1273550","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64298","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623194-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623221-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623231-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623237-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623241-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623244-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623477-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230238","tags":["report"]},{"url":"https://bugzilla.suse.com/1235944","tags":["report"]},{"url":"https://bugzilla.suse.com/1250748","tags":["report"]},{"url":"https://bugzilla.suse.com/1255225","tags":["report"]},{"url":"https://bugzilla.suse.com/1256629","tags":["report"]},{"url":"https://bugzilla.suse.com/1256708","tags":["report"]},{"url":"https://bugzilla.suse.com/1257154","tags":["report"]},{"url":"https://bugzilla.suse.com/1258430","tags":["report"]},{"url":"https://bugzilla.suse.com/1258517","tags":["report"]},{"url":"https://bugzilla.suse.com/1260522","tags":["report"]},{"url":"https://bugzilla.suse.com/1261780","tags":["report"]},{"url":"https://bugzilla.suse.com/1261788","tags":["report"]},{"url":"https://bugzilla.suse.com/1262073","tags":["report"]},{"url":"https://bugzilla.suse.com/1263004","tags":["report"]},{"url":"https://bugzilla.suse.com/1263133","tags":["report"]},{"url":"https://bugzilla.suse.com/1264335","tags":["report"]},{"url":"https://bugzilla.suse.com/1264541","tags":["report"]},{"url":"https://bugzilla.suse.com/1264587","tags":["report"]},{"url":"https://bugzilla.suse.com/1264619","tags":["report"]},{"url":"https://bugzilla.suse.com/1265068","tags":["report"]},{"url":"https://bugzilla.suse.com/1265121","tags":["report"]},{"url":"https://bugzilla.suse.com/1266860","tags":["report"]},{"url":"https://bugzilla.suse.com/1266874","tags":["report"]},{"url":"https://bugzilla.suse.com/1266897","tags":["report"]},{"url":"https://bugzilla.suse.com/1267023","tags":["report"]},{"url":"https://bugzilla.suse.com/1267238","tags":["report"]},{"url":"https://bugzilla.suse.com/1267501","tags":["report"]},{"url":"https://bugzilla.suse.com/1267612","tags":["report"]},{"url":"https://bugzilla.suse.com/1268276","tags":["report"]},{"url":"https://bugzilla.suse.com/1268972","tags":["report"]},{"url":"https://bugzilla.suse.com/1268979","tags":["report"]},{"url":"https://bugzilla.suse.com/1269004","tags":["report"]},{"url":"https://bugzilla.suse.com/1269013","tags":["report"]},{"url":"https://bugzilla.suse.com/1269108","tags":["report"]},{"url":"https://bugzilla.suse.com/1269113","tags":["report"]},{"url":"https://bugzilla.suse.com/1269114","tags":["report"]},{"url":"https://bugzilla.suse.com/1269126","tags":["report"]},{"url":"https://bugzilla.suse.com/1269167","tags":["report"]},{"url":"https://bugzilla.suse.com/1269234","tags":["report"]},{"url":"https://bugzilla.suse.com/1269238","tags":["report"]},{"url":"https://bugzilla.suse.com/1269242","tags":["report"]},{"url":"https://bugzilla.suse.com/1269256","tags":["report"]},{"url":"https://bugzilla.suse.com/1269301","tags":["report"]},{"url":"https://bugzilla.suse.com/1269306","tags":["report"]},{"url":"https://bugzilla.suse.com/1269381","tags":["report"]},{"url":"https://bugzilla.suse.com/1269388","tags":["report"]},{"url":"https://bugzilla.suse.com/1269412","tags":["report"]},{"url":"https://bugzilla.suse.com/1269530","tags":["report"]},{"url":"https://bugzilla.suse.com/1269579","tags":["report"]},{"url":"https://bugzilla.suse.com/1269590","tags":["report"]},{"url":"https://bugzilla.suse.com/1269635","tags":["report"]},{"url":"https://bugzilla.suse.com/1269655","tags":["report"]},{"url":"https://bugzilla.suse.com/1269665","tags":["report"]},{"url":"https://bugzilla.suse.com/1269686","tags":["report"]},{"url":"https://bugzilla.suse.com/1269695","tags":["report"]},{"url":"https://bugzilla.suse.com/1269774","tags":["report"]},{"url":"https://bugzilla.suse.com/1269783","tags":["report"]},{"url":"https://bugzilla.suse.com/1269792","tags":["report"]},{"url":"https://bugzilla.suse.com/1269815","tags":["report"]},{"url":"https://bugzilla.suse.com/1269965","tags":["report"]},{"url":"https://bugzilla.suse.com/1269969","tags":["report"]},{"url":"https://bugzilla.suse.com/1269985","tags":["report"]},{"url":"https://bugzilla.suse.com/1270090","tags":["report"]},{"url":"https://bugzilla.suse.com/1270108","tags":["report"]},{"url":"https://bugzilla.suse.com/1270111","tags":["report"]},{"url":"https://bugzilla.suse.com/1270251","tags":["report"]},{"url":"https://bugzilla.suse.com/1271256","tags":["report"]},{"url":"https://bugzilla.suse.com/1271365","tags":["report"]},{"url":"https://bugzilla.suse.com/1272175","tags":["report"]},{"url":"https://bugzilla.suse.com/1272182","tags":["report"]},{"url":"https://bugzilla.suse.com/1272200","tags":["report"]},{"url":"https://bugzilla.suse.com/1272210","tags":["report"]},{"url":"https://bugzilla.suse.com/1272213","tags":["report"]},{"url":"https://bugzilla.suse.com/1272230","tags":["report"]},{"url":"https://bugzilla.suse.com/1272260","tags":["report"]},{"url":"https://bugzilla.suse.com/1272261","tags":["report"]},{"url":"https://bugzilla.suse.com/1272262","tags":["report"]},{"url":"https://bugzilla.suse.com/1272297","tags":["report"]},{"url":"https://bugzilla.suse.com/1272346","tags":["report"]},{"url":"https://bugzilla.suse.com/1272385","tags":["report"]},{"url":"https://bugzilla.suse.com/1272390","tags":["report"]},{"url":"https://bugzilla.suse.com/1272423","tags":["report"]},{"url":"https://bugzilla.suse.com/1272429","tags":["report"]},{"url":"https://bugzilla.suse.com/1272484","tags":["report"]},{"url":"https://bugzilla.suse.com/1272486","tags":["report"]},{"url":"https://bugzilla.suse.com/1272497","tags":["report"]},{"url":"https://bugzilla.suse.com/1272516","tags":["report"]},{"url":"https://bugzilla.suse.com/1272569","tags":["report"]},{"url":"https://bugzilla.suse.com/1272571","tags":["report"]},{"url":"https://bugzilla.suse.com/1272641","tags":["report"]},{"url":"https://bugzilla.suse.com/1272643","tags":["report"]},{"url":"https://bugzilla.suse.com/1272673","tags":["report"]},{"url":"https://bugzilla.suse.com/1272756","tags":["report"]},{"url":"https://bugzilla.suse.com/1272786","tags":["report"]},{"url":"https://bugzilla.suse.com/1272788","tags":["report"]},{"url":"https://bugzilla.suse.com/1272798","tags":["report"]},{"url":"https://bugzilla.suse.com/1272799","tags":["report"]},{"url":"https://bugzilla.suse.com/1272868","tags":["report"]},{"url":"https://bugzilla.suse.com/1272877","tags":["report"]},{"url":"https://bugzilla.suse.com/1272963","tags":["report"]},{"url":"https://bugzilla.suse.com/1272983","tags":["report"]},{"url":"https://bugzilla.suse.com/1273008","tags":["report"]},{"url":"https://bugzilla.suse.com/1273019","tags":["report"]},{"url":"https://bugzilla.suse.com/1273027","tags":["report"]},{"url":"https://bugzilla.suse.com/1273028","tags":["report"]},{"url":"https://bugzilla.suse.com/1273030","tags":["report"]},{"url":"https://bugzilla.suse.com/1273038","tags":["report"]},{"url":"https://bugzilla.suse.com/1273060","tags":["report"]},{"url":"https://bugzilla.suse.com/1273105","tags":["report"]},{"url":"https://bugzilla.suse.com/1273249","tags":["report"]},{"url":"https://bugzilla.suse.com/1273250","tags":["report"]},{"url":"https://bugzilla.suse.com/1273260","tags":["report"]},{"url":"https://bugzilla.suse.com/1273273","tags":["report"]},{"url":"https://bugzilla.suse.com/1273274","tags":["report"]},{"url":"https://bugzilla.suse.com/1273276","tags":["report"]},{"url":"https://bugzilla.suse.com/1273281","tags":["report"]},{"url":"https://bugzilla.suse.com/1273284","tags":["report"]},{"url":"https://bugzilla.suse.com/1273285","tags":["report"]},{"url":"https://bugzilla.suse.com/1273289","tags":["report"]},{"url":"https://bugzilla.suse.com/1273291","tags":["report"]},{"url":"https://bugzilla.suse.com/1273294","tags":["report"]},{"url":"https://bugzilla.suse.com/1273302","tags":["report"]},{"url":"https://bugzilla.suse.com/1273303","tags":["report"]},{"url":"https://bugzilla.suse.com/1273305","tags":["report"]},{"url":"https://bugzilla.suse.com/1273310","tags":["report"]},{"url":"https://bugzilla.suse.com/1273311","tags":["report"]},{"url":"https://bugzilla.suse.com/1273316","tags":["report"]},{"url":"https://bugzilla.suse.com/1273318","tags":["report"]},{"url":"https://bugzilla.suse.com/1273319","tags":["report"]},{"url":"https://bugzilla.suse.com/1273323","tags":["report"]},{"url":"https://bugzilla.suse.com/1273325","tags":["report"]},{"url":"https://bugzilla.suse.com/1273327","tags":["report"]},{"url":"https://bugzilla.suse.com/1273334","tags":["report"]},{"url":"https://bugzilla.suse.com/1273335","tags":["report"]},{"url":"https://bugzilla.suse.com/1273336","tags":["report"]},{"url":"https://bugzilla.suse.com/1273337","tags":["report"]},{"url":"https://bugzilla.suse.com/1273338","tags":["report"]},{"url":"https://bugzilla.suse.com/1273340","tags":["report"]},{"url":"https://bugzilla.suse.com/1273341","tags":["report"]},{"url":"https://bugzilla.suse.com/1273346","tags":["report"]},{"url":"https://bugzilla.suse.com/1273422","tags":["report"]},{"url":"https://bugzilla.suse.com/1273426","tags":["report"]},{"url":"https://bugzilla.suse.com/1273443","tags":["report"]},{"url":"https://bugzilla.suse.com/1273463","tags":["report"]},{"url":"https://bugzilla.suse.com/1273468","tags":["report"]},{"url":"https://bugzilla.suse.com/1273469","tags":["report"]},{"url":"https://bugzilla.suse.com/1273471","tags":["report"]},{"url":"https://bugzilla.suse.com/1273479","tags":["report"]},{"url":"https://bugzilla.suse.com/1273480","tags":["report"]},{"url":"https://bugzilla.suse.com/1273482","tags":["report"]},{"url":"https://bugzilla.suse.com/1273484","tags":["report"]},{"url":"https://bugzilla.suse.com/1273488","tags":["report"]},{"url":"https://bugzilla.suse.com/1273490","tags":["report"]},{"url":"https://bugzilla.suse.com/1273501","tags":["report"]},{"url":"https://bugzilla.suse.com/1273503","tags":["report"]},{"url":"https://bugzilla.suse.com/1273504","tags":["report"]},{"url":"https://bugzilla.suse.com/1273506","tags":["report"]},{"url":"https://bugzilla.suse.com/1273523","tags":["report"]},{"url":"https://bugzilla.suse.com/1273525","tags":["report"]},{"url":"https://bugzilla.suse.com/1273533","tags":["report"]},{"url":"https://bugzilla.suse.com/1273536","tags":["report"]},{"url":"https://bugzilla.suse.com/1273542","tags":["report"]},{"url":"https://bugzilla.suse.com/1273555","tags":["report"]},{"url":"https://bugzilla.suse.com/1273578","tags":["report"]},{"url":"https://bugzilla.suse.com/1273579","tags":["report"]},{"url":"https://bugzilla.suse.com/1273582","tags":["report"]},{"url":"https://bugzilla.suse.com/1273596","tags":["report"]},{"url":"https://bugzilla.suse.com/1273597","tags":["report"]},{"url":"https://bugzilla.suse.com/1273598","tags":["report"]},{"url":"https://bugzilla.suse.com/1273600","tags":["report"]},{"url":"https://bugzilla.suse.com/1273601","tags":["report"]},{"url":"https://bugzilla.suse.com/1273602","tags":["report"]},{"url":"https://bugzilla.suse.com/1273603","tags":["report"]},{"url":"https://bugzilla.suse.com/1273682","tags":["report"]},{"url":"https://bugzilla.suse.com/1273734","tags":["report"]},{"url":"https://bugzilla.suse.com/1273738","tags":["report"]},{"url":"https://bugzilla.suse.com/1273739","tags":["report"]},{"url":"https://bugzilla.suse.com/1273741","tags":["report"]},{"url":"https://bugzilla.suse.com/1273742","tags":["report"]},{"url":"https://bugzilla.suse.com/1273743","tags":["report"]},{"url":"https://bugzilla.suse.com/1273745","tags":["report"]},{"url":"https://bugzilla.suse.com/1273748","tags":["report"]},{"url":"https://bugzilla.suse.com/1273749","tags":["report"]},{"url":"https://bugzilla.suse.com/1273755","tags":["report"]},{"url":"https://bugzilla.suse.com/1273762","tags":["report"]},{"url":"https://bugzilla.suse.com/1273765","tags":["report"]},{"url":"https://bugzilla.suse.com/1273766","tags":["report"]},{"url":"https://bugzilla.suse.com/1273769","tags":["report"]},{"url":"https://bugzilla.suse.com/1273774","tags":["report"]},{"url":"https://bugzilla.suse.com/1273778","tags":["report"]},{"url":"https://bugzilla.suse.com/1273780","tags":["report"]},{"url":"https://bugzilla.suse.com/1273790","tags":["report"]},{"url":"https://bugzilla.suse.com/1273796","tags":["report"]},{"url":"https://bugzilla.suse.com/1273804","tags":["report"]},{"url":"https://bugzilla.suse.com/1273810","tags":["report"]},{"url":"https://bugzilla.suse.com/1273811","tags":["report"]},{"url":"https://bugzilla.suse.com/1273813","tags":["report"]},{"url":"https://bugzilla.suse.com/1273817","tags":["report"]},{"url":"https://bugzilla.suse.com/1273822","tags":["report"]},{"url":"https://bugzilla.suse.com/1273824","tags":["report"]},{"url":"https://bugzilla.suse.com/1273831","tags":["report"]},{"url":"https://bugzilla.suse.com/1273832","tags":["report"]},{"url":"https://bugzilla.suse.com/1273834","tags":["report"]},{"url":"https://bugzilla.suse.com/1273838","tags":["report"]},{"url":"https://bugzilla.suse.com/1273844","tags":["report"]},{"url":"https://bugzilla.suse.com/1273849","tags":["report"]},{"url":"https://bugzilla.suse.com/1273860","tags":["report"]},{"url":"https://bugzilla.suse.com/1273862","tags":["report"]},{"url":"https://bugzilla.suse.com/1273867","tags":["report"]},{"url":"https://bugzilla.suse.com/1273868","tags":["report"]},{"url":"https://bugzilla.suse.com/1273869","tags":["report"]},{"url":"https://bugzilla.suse.com/1273872","tags":["report"]},{"url":"https://bugzilla.suse.com/1273876","tags":["report"]},{"url":"https://bugzilla.suse.com/1273877","tags":["report"]},{"url":"https://bugzilla.suse.com/1273880","tags":["report"]},{"url":"https://bugzilla.suse.com/1273882","tags":["report"]},{"url":"https://bugzilla.suse.com/1273890","tags":["report"]},{"url":"https://bugzilla.suse.com/1273891","tags":["report"]},{"url":"https://bugzilla.suse.com/1273892","tags":["report"]},{"url":"https://bugzilla.suse.com/1273895","tags":["report"]},{"url":"https://bugzilla.suse.com/1273896","tags":["report"]},{"url":"https://bugzilla.suse.com/1273903","tags":["report"]},{"url":"https://bugzilla.suse.com/1273905","tags":["report"]},{"url":"https://bugzilla.suse.com/1273930","tags":["report"]},{"url":"https://bugzilla.suse.com/1273933","tags":["report"]},{"url":"https://bugzilla.suse.com/1273934","tags":["report"]},{"url":"https://bugzilla.suse.com/1273935","tags":["report"]},{"url":"https://bugzilla.suse.com/1273936","tags":["report"]},{"url":"https://bugzilla.suse.com/1273939","tags":["report"]},{"url":"https://bugzilla.suse.com/1273940","tags":["report"]},{"url":"https://bugzilla.suse.com/1273941","tags":["report"]},{"url":"https://bugzilla.suse.com/1273942","tags":["report"]},{"url":"https://bugzilla.suse.com/1273944","tags":["report"]},{"url":"https://bugzilla.suse.com/1273945","tags":["report"]},{"url":"https://bugzilla.suse.com/1273946","tags":["report"]},{"url":"https://bugzilla.suse.com/1273956","tags":["report"]},{"url":"https://bugzilla.suse.com/1273957","tags":["report"]},{"url":"https://bugzilla.suse.com/1273958","tags":["report"]},{"url":"https://bugzilla.suse.com/1273966","tags":["report"]},{"url":"https://bugzilla.suse.com/1273967","tags":["report"]},{"url":"https://bugzilla.suse.com/1273968","tags":["report"]},{"url":"https://bugzilla.suse.com/1273972","tags":["report"]},{"url":"https://bugzilla.suse.com/1273974","tags":["report"]},{"url":"https://bugzilla.suse.com/1273975","tags":["report"]},{"url":"https://bugzilla.suse.com/1273977","tags":["report"]},{"url":"https://bugzilla.suse.com/1273982","tags":["report"]},{"url":"https://bugzilla.suse.com/1273988","tags":["report"]},{"url":"https://bugzilla.suse.com/1273990","tags":["report"]},{"url":"https://bugzilla.suse.com/1273991","tags":["report"]},{"url":"https://bugzilla.suse.com/1273995","tags":["report"]},{"url":"https://bugzilla.suse.com/1274001","tags":["report"]},{"url":"https://bugzilla.suse.com/1274003","tags":["report"]},{"url":"https://bugzilla.suse.com/1274006","tags":["report"]},{"url":"https://bugzilla.suse.com/1274011","tags":["report"]},{"url":"https://bugzilla.suse.com/1274012","tags":["report"]},{"url":"https://bugzilla.suse.com/1274014","tags":["report"]},{"url":"https://bugzilla.suse.com/1274017","tags":["report"]},{"url":"https://bugzilla.suse.com/1274019","tags":["report"]},{"url":"https://bugzilla.suse.com/1274020","tags":["report"]},{"url":"https://bugzilla.suse.com/1274026","tags":["report"]},{"url":"https://bugzilla.suse.com/1274028","tags":["report"]},{"url":"https://bugzilla.suse.com/1274030","tags":["report"]},{"url":"https://bugzilla.suse.com/1274031","tags":["report"]},{"url":"https://bugzilla.suse.com/1274035","tags":["report"]},{"url":"https://bugzilla.suse.com/1274040","tags":["report"]},{"url":"https://bugzilla.suse.com/1274041","tags":["report"]},{"url":"https://bugzilla.suse.com/1274057","tags":["report"]},{"url":"https://bugzilla.suse.com/1274058","tags":["report"]},{"url":"https://bugzilla.suse.com/1274061","tags":["report"]},{"url":"https://bugzilla.suse.com/1274063","tags":["report"]},{"url":"https://bugzilla.suse.com/1274065","tags":["report"]},{"url":"https://bugzilla.suse.com/1274067","tags":["report"]},{"url":"https://bugzilla.suse.com/1274075","tags":["report"]},{"url":"https://bugzilla.suse.com/1274076","tags":["report"]},{"url":"https://bugzilla.suse.com/1274077","tags":["report"]},{"url":"https://bugzilla.suse.com/1274078","tags":["report"]},{"url":"https://bugzilla.suse.com/1274208","tags":["report"]},{"url":"https://bugzilla.suse.com/1274226","tags":["report"]},{"url":"https://bugzilla.suse.com/1274239","tags":["report"]},{"url":"https://bugzilla.suse.com/1274243","tags":["report"]},{"url":"https://bugzilla.suse.com/1274258","tags":["report"]},{"url":"https://bugzilla.suse.com/1274265","tags":["report"]},{"url":"https://bugzilla.suse.com/1274274","tags":["report"]},{"url":"https://bugzilla.suse.com/1274277","tags":["report"]},{"url":"https://bugzilla.suse.com/1274278","tags":["report"]},{"url":"https://bugzilla.suse.com/1274281","tags":["report"]},{"url":"https://bugzilla.suse.com/1274283","tags":["report"]},{"url":"https://bugzilla.suse.com/1274286","tags":["report"]},{"url":"https://bugzilla.suse.com/1274290","tags":["report"]},{"url":"https://bugzilla.suse.com/1274294","tags":["report"]},{"url":"https://bugzilla.suse.com/1274296","tags":["report"]},{"url":"https://bugzilla.suse.com/1274297","tags":["report"]},{"url":"https://bugzilla.suse.com/1274298","tags":["report"]},{"url":"https://bugzilla.suse.com/1274314","tags":["report"]},{"url":"https://bugzilla.suse.com/1274321","tags":["report"]},{"url":"https://bugzilla.suse.com/1274491","tags":["report"]},{"url":"https://bugzilla.suse.com/1274497","tags":["report"]},{"url":"https://bugzilla.suse.com/1274539","tags":["report"]},{"url":"https://bugzilla.suse.com/1274541","tags":["report"]},{"url":"https://bugzilla.suse.com/1274543","tags":["report"]},{"url":"https://bugzilla.suse.com/1274545","tags":["report"]},{"url":"https://bugzilla.suse.com/1274547","tags":["report"]},{"url":"https://bugzilla.suse.com/1274550","tags":["report"]},{"url":"https://bugzilla.suse.com/1274573","tags":["report"]},{"url":"https://bugzilla.suse.com/1274578","tags":["report"]},{"url":"https://bugzilla.suse.com/1274580","tags":["report"]},{"url":"https://bugzilla.suse.com/1274581","tags":["report"]},{"url":"https://bugzilla.suse.com/1274620","tags":["report"]},{"url":"https://bugzilla.suse.com/1274622","tags":["report"]},{"url":"https://bugzilla.suse.com/1274624","tags":["report"]},{"url":"https://bugzilla.suse.com/1274629","tags":["report"]},{"url":"https://bugzilla.suse.com/1274632","tags":["report"]},{"url":"https://bugzilla.suse.com/1274636","tags":["report"]},{"url":"https://bugzilla.suse.com/1274639","tags":["report"]},{"url":"https://bugzilla.suse.com/1274640","tags":["report"]},{"url":"https://bugzilla.suse.com/1274642","tags":["report"]},{"url":"https://bugzilla.suse.com/1274644","tags":["report"]},{"url":"https://bugzilla.suse.com/1274645","tags":["report"]},{"url":"https://bugzilla.suse.com/1274646","tags":["report"]},{"url":"https://bugzilla.suse.com/1274649","tags":["report"]},{"url":"https://bugzilla.suse.com/1274650","tags":["report"]},{"url":"https://bugzilla.suse.com/1274651","tags":["report"]},{"url":"https://bugzilla.suse.com/1274656","tags":["report"]},{"url":"https://bugzilla.suse.com/1274659","tags":["report"]},{"url":"https://bugzilla.suse.com/1274662","tags":["report"]},{"url":"https://bugzilla.suse.com/1274663","tags":["report"]},{"url":"https://bugzilla.suse.com/1274665","tags":["report"]},{"url":"https://bugzilla.suse.com/1274667","tags":["report"]},{"url":"https://bugzilla.suse.com/1274670","tags":["report"]},{"url":"https://bugzilla.suse.com/1274675","tags":["report"]},{"url":"https://bugzilla.suse.com/1274677","tags":["report"]},{"url":"https://bugzilla.suse.com/1274678","tags":["report"]},{"url":"https://bugzilla.suse.com/1274679","tags":["report"]},{"url":"https://bugzilla.suse.com/1274681","tags":["report"]},{"url":"https://bugzilla.suse.com/1274682","tags":["report"]},{"url":"https://bugzilla.suse.com/1274690","tags":["report"]},{"url":"https://bugzilla.suse.com/1274694","tags":["report"]},{"url":"https://bugzilla.suse.com/1274696","tags":["report"]},{"url":"https://bugzilla.suse.com/1274698","tags":["report"]},{"url":"https://bugzilla.suse.com/1274699","tags":["report"]},{"url":"https://bugzilla.suse.com/1274700","tags":["report"]},{"url":"https://bugzilla.suse.com/1274702","tags":["report"]},{"url":"https://bugzilla.suse.com/1274703","tags":["report"]},{"url":"https://bugzilla.suse.com/1274705","tags":["report"]},{"url":"https://bugzilla.suse.com/1274706","tags":["report"]},{"url":"https://bugzilla.suse.com/1274709","tags":["report"]},{"url":"https://bugzilla.suse.com/1274710","tags":["report"]},{"url":"https://bugzilla.suse.com/1274713","tags":["report"]},{"url":"https://bugzilla.suse.com/1274716","tags":["report"]},{"url":"https://bugzilla.suse.com/1274721","tags":["report"]},{"url":"https://bugzilla.suse.com/1274725","tags":["report"]},{"url":"https://bugzilla.suse.com/1274737","tags":["report"]},{"url":"https://bugzilla.suse.com/1274738","tags":["report"]},{"url":"https://bugzilla.suse.com/1274749","tags":["report"]},{"url":"https://bugzilla.suse.com/1274752","tags":["report"]},{"url":"https://bugzilla.suse.com/1274753","tags":["report"]},{"url":"https://bugzilla.suse.com/1274754","tags":["report"]},{"url":"https://bugzilla.suse.com/1274755","tags":["report"]},{"url":"https://bugzilla.suse.com/1274756","tags":["report"]},{"url":"https://bugzilla.suse.com/1274764","tags":["report"]},{"url":"https://bugzilla.suse.com/1274768","tags":["report"]},{"url":"https://bugzilla.suse.com/1274770","tags":["report"]},{"url":"https://bugzilla.suse.com/1274787","tags":["report"]},{"url":"https://bugzilla.suse.com/1274800","tags":["report"]},{"url":"https://bugzilla.suse.com/1274801","tags":["report"]},{"url":"https://bugzilla.suse.com/1274802","tags":["report"]},{"url":"https://bugzilla.suse.com/1274804","tags":["report"]},{"url":"https://bugzilla.suse.com/1274805","tags":["report"]},{"url":"https://bugzilla.suse.com/1274807","tags":["report"]},{"url":"https://bugzilla.suse.com/1274808","tags":["report"]},{"url":"https://bugzilla.suse.com/1274811","tags":["report"]},{"url":"https://bugzilla.suse.com/1274813","tags":["report"]},{"url":"https://bugzilla.suse.com/1274814","tags":["report"]},{"url":"https://bugzilla.suse.com/1274831","tags":["report"]},{"url":"https://bugzilla.suse.com/1274834","tags":["report"]},{"url":"https://bugzilla.suse.com/1274847","tags":["report"]},{"url":"https://bugzilla.suse.com/1274853","tags":["report"]},{"url":"https://bugzilla.suse.com/1274868","tags":["report"]},{"url":"https://bugzilla.suse.com/1274869","tags":["report"]},{"url":"https://bugzilla.suse.com/1274872","tags":["report"]},{"url":"https://bugzilla.suse.com/1274873","tags":["report"]},{"url":"https://bugzilla.suse.com/1274874","tags":["report"]},{"url":"https://bugzilla.suse.com/1274876","tags":["report"]},{"url":"https://bugzilla.suse.com/1274879","tags":["report"]},{"url":"https://bugzilla.suse.com/1274881","tags":["report"]},{"url":"https://bugzilla.suse.com/1274883","tags":["report"]},{"url":"https://bugzilla.suse.com/1274886","tags":["report"]},{"url":"https://bugzilla.suse.com/1274888","tags":["report"]},{"url":"https://bugzilla.suse.com/1274891","tags":["report"]},{"url":"https://bugzilla.suse.com/1274892","tags":["report"]},{"url":"https://bugzilla.suse.com/1274893","tags":["report"]},{"url":"https://bugzilla.suse.com/1274894","tags":["report"]},{"url":"https://bugzilla.suse.com/1274896","tags":["report"]},{"url":"https://bugzilla.suse.com/1274897","tags":["report"]},{"url":"https://bugzilla.suse.com/1274898","tags":["report"]},{"url":"https://bugzilla.suse.com/1274899","tags":["report"]},{"url":"https://bugzilla.suse.com/1274901","tags":["report"]},{"url":"https://bugzilla.suse.com/1274902","tags":["report"]},{"url":"https://bugzilla.suse.com/1274905","tags":["report"]},{"url":"https://bugzilla.suse.com/1274907","tags":["report"]},{"url":"https://bugzilla.suse.com/1274908","tags":["report"]},{"url":"https://bugzilla.suse.com/1274913","tags":["report"]},{"url":"https://bugzilla.suse.com/1274914","tags":["report"]},{"url":"https://bugzilla.suse.com/1274920","tags":["report"]},{"url":"https://bugzilla.suse.com/1274921","tags":["report"]},{"url":"https://bugzilla.suse.com/1274924","tags":["report"]},{"url":"https://bugzilla.suse.com/1274925","tags":["report"]},{"url":"https://bugzilla.suse.com/1274929","tags":["report"]},{"url":"https://bugzilla.suse.com/1274930","tags":["report"]},{"url":"https://bugzilla.suse.com/1274933","tags":["report"]},{"url":"https://bugzilla.suse.com/1274934","tags":["report"]},{"url":"https://bugzilla.suse.com/1274935","tags":["report"]},{"url":"https://bugzilla.suse.com/1274941","tags":["report"]},{"url":"https://bugzilla.suse.com/1274945","tags":["report"]},{"url":"https://bugzilla.suse.com/1274947","tags":["report"]},{"url":"https://bugzilla.suse.com/1274951","tags":["report"]},{"url":"https://bugzilla.suse.com/1274953","tags":["report"]},{"url":"https://bugzilla.suse.com/1274958","tags":["report"]},{"url":"https://bugzilla.suse.com/1274968","tags":["report"]},{"url":"https://bugzilla.suse.com/1274981","tags":["report"]},{"url":"https://bugzilla.suse.com/1275040","tags":["report"]},{"url":"https://bugzilla.suse.com/1275069","tags":["report"]},{"url":"https://bugzilla.suse.com/1275071","tags":["report"]},{"url":"https://bugzilla.suse.com/1275073","tags":["report"]},{"url":"https://bugzilla.suse.com/1275076","tags":["report"]},{"url":"https://bugzilla.suse.com/1275080","tags":["report"]},{"url":"https://bugzilla.suse.com/1275083","tags":["report"]},{"url":"https://bugzilla.suse.com/1275088","tags":["report"]},{"url":"https://bugzilla.suse.com/1275091","tags":["report"]},{"url":"https://bugzilla.suse.com/1275125","tags":["report"]},{"url":"https://bugzilla.suse.com/1275126","tags":["report"]},{"url":"https://bugzilla.suse.com/1275131","tags":["report"]},{"url":"https://bugzilla.suse.com/1275132","tags":["report"]},{"url":"https://bugzilla.suse.com/1275150","tags":["report"]},{"url":"https://bugzilla.suse.com/1275152","tags":["report"]},{"url":"https://bugzilla.suse.com/1275154","tags":["report"]},{"url":"https://bugzilla.suse.com/1275155","tags":["report"]},{"url":"https://bugzilla.suse.com/1275157","tags":["report"]},{"url":"https://bugzilla.suse.com/1275158","tags":["report"]},{"url":"https://bugzilla.suse.com/1275161","tags":["report"]},{"url":"https://bugzilla.suse.com/1275163","tags":["report"]},{"url":"https://bugzilla.suse.com/1275164","tags":["report"]},{"url":"https://bugzilla.suse.com/1275169","tags":["report"]},{"url":"https://bugzilla.suse.com/1275173","tags":["report"]},{"url":"https://bugzilla.suse.com/1275176","tags":["report"]},{"url":"https://bugzilla.suse.com/1275185","tags":["report"]},{"url":"https://bugzilla.suse.com/1275190","tags":["report"]},{"url":"https://bugzilla.suse.com/1275236","tags":["report"]},{"url":"https://bugzilla.suse.com/1275237","tags":["report"]},{"url":"https://bugzilla.suse.com/1275239","tags":["report"]},{"url":"https://bugzilla.suse.com/1275294","tags":["report"]},{"url":"https://bugzilla.suse.com/1275301","tags":["report"]},{"url":"https://bugzilla.suse.com/1275303","tags":["report"]},{"url":"https://bugzilla.suse.com/1275304","tags":["report"]},{"url":"https://bugzilla.suse.com/1275305","tags":["report"]},{"url":"https://bugzilla.suse.com/1275306","tags":["report"]},{"url":"https://bugzilla.suse.com/1275307","tags":["report"]},{"url":"https://bugzilla.suse.com/1275470","tags":["report"]},{"url":"https://bugzilla.suse.com/1275472","tags":["report"]},{"url":"https://bugzilla.suse.com/1275474","tags":["report"]},{"url":"https://bugzilla.suse.com/1275479","tags":["report"]},{"url":"https://bugzilla.suse.com/1275483","tags":["report"]},{"url":"https://bugzilla.suse.com/1275486","tags":["report"]},{"url":"https://bugzilla.suse.com/1275487","tags":["report"]},{"url":"https://bugzilla.suse.com/1275506","tags":["report"]},{"url":"https://bugzilla.suse.com/1275509","tags":["report"]},{"url":"https://bugzilla.suse.com/1275511","tags":["report"]},{"url":"https://bugzilla.suse.com/1275517","tags":["report"]},{"url":"https://bugzilla.suse.com/1275528","tags":["report"]},{"url":"https://bugzilla.suse.com/1275535","tags":["report"]},{"url":"https://bugzilla.suse.com/1275540","tags":["report"]},{"url":"https://bugzilla.suse.com/1275553","tags":["report"]},{"url":"https://bugzilla.suse.com/1275555","tags":["report"]},{"url":"https://bugzilla.suse.com/1275561","tags":["report"]},{"url":"https://bugzilla.suse.com/1275566","tags":["report"]},{"url":"https://bugzilla.suse.com/1275569","tags":["report"]},{"url":"https://bugzilla.suse.com/1275574","tags":["report"]},{"url":"https://bugzilla.suse.com/1275578","tags":["report"]},{"url":"https://bugzilla.suse.com/1275582","tags":["report"]},{"url":"https://bugzilla.suse.com/1275583","tags":["report"]},{"url":"https://bugzilla.suse.com/1275584","tags":["report"]},{"url":"https://bugzilla.suse.com/1275591","tags":["report"]},{"url":"https://bugzilla.suse.com/1275595","tags":["report"]},{"url":"https://bugzilla.suse.com/1275633","tags":["report"]},{"url":"https://bugzilla.suse.com/1275636","tags":["report"]},{"url":"https://bugzilla.suse.com/1275650","tags":["report"]},{"url":"https://bugzilla.suse.com/1275659","tags":["report"]},{"url":"https://bugzilla.suse.com/1275665","tags":["report"]},{"url":"https://bugzilla.suse.com/1275669","tags":["report"]},{"url":"https://bugzilla.suse.com/1275687","tags":["report"]},{"url":"https://bugzilla.suse.com/1275688","tags":["report"]},{"url":"https://bugzilla.suse.com/1275695","tags":["report"]},{"url":"https://bugzilla.suse.com/1275696","tags":["report"]},{"url":"https://bugzilla.suse.com/1275704","tags":["report"]},{"url":"https://bugzilla.suse.com/1275782","tags":["report"]},{"url":"https://bugzilla.suse.com/1275784","tags":["report"]},{"url":"https://bugzilla.suse.com/1275787","tags":["report"]},{"url":"https://bugzilla.suse.com/1275788","tags":["report"]},{"url":"https://bugzilla.suse.com/1275790","tags":["report"]},{"url":"https://bugzilla.suse.com/1275797","tags":["report"]},{"url":"https://bugzilla.suse.com/1275798","tags":["report"]},{"url":"https://bugzilla.suse.com/1275805","tags":["report"]},{"url":"https://bugzilla.suse.com/1275817","tags":["report"]},{"url":"https://bugzilla.suse.com/1275818","tags":["report"]},{"url":"https://bugzilla.suse.com/1275819","tags":["report"]},{"url":"https://bugzilla.suse.com/1275820","tags":["report"]},{"url":"https://bugzilla.suse.com/1275821","tags":["report"]},{"url":"https://bugzilla.suse.com/1275827","tags":["report"]},{"url":"https://bugzilla.suse.com/1275864","tags":["report"]},{"url":"https://bugzilla.suse.com/1275867","tags":["report"]},{"url":"https://bugzilla.suse.com/1275869","tags":["report"]},{"url":"https://bugzilla.suse.com/1275870","tags":["report"]},{"url":"https://bugzilla.suse.com/1275871","tags":["report"]},{"url":"https://bugzilla.suse.com/1275872","tags":["report"]},{"url":"https://bugzilla.suse.com/1275886","tags":["report"]},{"url":"https://bugzilla.suse.com/1275905","tags":["report"]},{"url":"https://bugzilla.suse.com/1275923","tags":["report"]},{"url":"https://bugzilla.suse.com/1275925","tags":["report"]},{"url":"https://bugzilla.suse.com/1275946","tags":["report"]},{"url":"https://bugzilla.suse.com/1275950","tags":["report"]},{"url":"https://bugzilla.suse.com/1275954","tags":["report"]},{"url":"https://bugzilla.suse.com/1275970","tags":["report"]},{"url":"https://bugzilla.suse.com/1275973","tags":["report"]},{"url":"https://bugzilla.suse.com/1275975","tags":["report"]},{"url":"https://bugzilla.suse.com/1275976","tags":["report"]},{"url":"https://bugzilla.suse.com/1276029","tags":["report"]},{"url":"https://bugzilla.suse.com/1276257","tags":["report"]},{"url":"https://bugzilla.suse.com/1276263","tags":["report"]},{"url":"https://bugzilla.suse.com/1276270","tags":["report"]},{"url":"https://bugzilla.suse.com/1276273","tags":["report"]},{"url":"https://bugzilla.suse.com/1276277","tags":["report"]},{"url":"https://bugzilla.suse.com/1276335","tags":["report"]},{"url":"https://bugzilla.suse.com/1276346","tags":["report"]},{"url":"https://bugzilla.suse.com/1276350","tags":["report"]},{"url":"https://bugzilla.suse.com/1276355","tags":["report"]},{"url":"https://bugzilla.suse.com/1276446","tags":["report"]},{"url":"https://bugzilla.suse.com/1276452","tags":["report"]},{"url":"https://bugzilla.suse.com/1276500","tags":["report"]},{"url":"https://bugzilla.suse.com/1276507","tags":["report"]},{"url":"https://bugzilla.suse.com/1276542","tags":["report"]},{"url":"https://bugzilla.suse.com/1276546","tags":["report"]},{"url":"https://bugzilla.suse.com/1276551","tags":["report"]},{"url":"https://bugzilla.suse.com/1276561","tags":["report"]},{"url":"https://bugzilla.suse.com/1276569","tags":["report"]},{"url":"https://bugzilla.suse.com/1276665","tags":["report"]},{"url":"https://bugzilla.suse.com/1276864","tags":["report"]},{"url":"https://bugzilla.suse.com/1276927","tags":["report"]},{"url":"https://bugzilla.suse.com/1276931","tags":["report"]},{"url":"https://bugzilla.suse.com/1276937","tags":["report"]},{"url":"https://bugzilla.suse.com/1276941","tags":["report"]},{"url":"https://bugzilla.suse.com/1276943","tags":["report"]},{"url":"https://bugzilla.suse.com/1276961","tags":["report"]},{"url":"https://bugzilla.suse.com/1277022","tags":["report"]},{"url":"https://bugzilla.suse.com/1277034","tags":["report"]},{"url":"https://bugzilla.suse.com/1277037","tags":["report"]},{"url":"https://bugzilla.suse.com/1277047","tags":["report"]},{"url":"https://bugzilla.suse.com/1277054","tags":["report"]},{"url":"https://bugzilla.suse.com/1277057","tags":["report"]},{"url":"https://bugzilla.suse.com/1277059","tags":["report"]},{"url":"https://bugzilla.suse.com/1277064","tags":["report"]},{"url":"https://bugzilla.suse.com/1277066","tags":["report"]},{"url":"https://bugzilla.suse.com/1277069","tags":["report"]},{"url":"https://bugzilla.suse.com/1277073","tags":["report"]},{"url":"https://bugzilla.suse.com/1277077","tags":["report"]},{"url":"https://bugzilla.suse.com/1277095","tags":["report"]},{"url":"https://bugzilla.suse.com/1277155","tags":["report"]},{"url":"https://bugzilla.suse.com/1277159","tags":["report"]},{"url":"https://bugzilla.suse.com/1277160","tags":["report"]},{"url":"https://bugzilla.suse.com/1277202","tags":["report"]},{"url":"https://bugzilla.suse.com/1277204","tags":["report"]},{"url":"https://bugzilla.suse.com/1277275","tags":["report"]},{"url":"https://bugzilla.suse.com/1277285","tags":["report"]},{"url":"https://bugzilla.suse.com/1277391","tags":["report"]},{"url":"https://bugzilla.suse.com/1277408","tags":["report"]},{"url":"https://bugzilla.suse.com/1277516","tags":["report"]},{"url":"https://bugzilla.suse.com/1277523","tags":["report"]},{"url":"https://bugzilla.suse.com/1277551","tags":["report"]},{"url":"https://bugzilla.suse.com/1277625","tags":["report"]},{"url":"https://bugzilla.suse.com/1277660","tags":["report"]},{"url":"https://bugzilla.suse.com/1277678","tags":["report"]},{"url":"https://bugzilla.suse.com/1277688","tags":["report"]},{"url":"https://bugzilla.suse.com/1277775","tags":["report"]},{"url":"https://bugzilla.suse.com/1277776","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80654","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623481-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623528-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623529-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263790-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268648","tags":["report"]},{"url":"https://bugzilla.suse.com/1271250","tags":["report"]},{"url":"https://bugzilla.suse.com/1271283","tags":["report"]},{"url":"https://bugzilla.suse.com/1271285","tags":["report"]},{"url":"https://bugzilla.suse.com/1271402","tags":["report"]},{"url":"https://bugzilla.suse.com/1272325","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263810-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236344","tags":["report"]},{"url":"https://bugzilla.suse.com/1240957","tags":["report"]},{"url":"https://bugzilla.suse.com/1241363","tags":["report"]},{"url":"https://bugzilla.suse.com/1247180","tags":["report"]},{"url":"https://bugzilla.suse.com/1249104","tags":["report"]},{"url":"https://bugzilla.suse.com/1251130","tags":["report"]},{"url":"https://bugzilla.suse.com/1263052","tags":["report"]},{"url":"https://bugzilla.suse.com/1263864","tags":["report"]},{"url":"https://bugzilla.suse.com/1264010","tags":["report"]},{"url":"https://bugzilla.suse.com/1264012","tags":["report"]},{"url":"https://bugzilla.suse.com/1264643","tags":["report"]},{"url":"https://bugzilla.suse.com/1264740","tags":["report"]},{"url":"https://bugzilla.suse.com/1264807","tags":["report"]},{"url":"https://bugzilla.suse.com/1265220","tags":["report"]},{"url":"https://bugzilla.suse.com/1267505","tags":["report"]},{"url":"https://bugzilla.suse.com/1269140","tags":["report"]},{"url":"https://bugzilla.suse.com/1269313","tags":["report"]},{"url":"https://bugzilla.suse.com/1269402","tags":["report"]},{"url":"https://bugzilla.suse.com/1269647","tags":["report"]},{"url":"https://bugzilla.suse.com/1269888","tags":["report"]},{"url":"https://bugzilla.suse.com/1270263","tags":["report"]},{"url":"https://bugzilla.suse.com/1270268","tags":["report"]},{"url":"https://bugzilla.suse.com/1272351","tags":["report"]},{"url":"https://bugzilla.suse.com/1272502","tags":["report"]},{"url":"https://bugzilla.suse.com/1272804","tags":["report"]},{"url":"https://bugzilla.suse.com/1272893","tags":["report"]},{"url":"https://bugzilla.suse.com/1273032","tags":["report"]},{"url":"https://bugzilla.suse.com/1273033","tags":["report"]},{"url":"https://bugzilla.suse.com/1273036","tags":["report"]},{"url":"https://bugzilla.suse.com/1273037","tags":["report"]},{"url":"https://bugzilla.suse.com/1273134","tags":["report"]},{"url":"https://bugzilla.suse.com/1273277","tags":["report"]},{"url":"https://bugzilla.suse.com/1273280","tags":["report"]},{"url":"https://bugzilla.suse.com/1273460","tags":["report"]},{"url":"https://bugzilla.suse.com/1273465","tags":["report"]},{"url":"https://bugzilla.suse.com/1273581","tags":["report"]},{"url":"https://bugzilla.suse.com/1273679","tags":["report"]},{"url":"https://bugzilla.suse.com/1273681","tags":["report"]},{"url":"https://bugzilla.suse.com/1273797","tags":["report"]},{"url":"https://bugzilla.suse.com/1273801","tags":["report"]},{"url":"https://bugzilla.suse.com/1273812","tags":["report"]},{"url":"https://bugzilla.suse.com/1273859","tags":["report"]},{"url":"https://bugzilla.suse.com/1274008","tags":["report"]},{"url":"https://bugzilla.suse.com/1274009","tags":["report"]},{"url":"https://bugzilla.suse.com/1274010","tags":["report"]},{"url":"https://bugzilla.suse.com/1274055","tags":["report"]},{"url":"https://bugzilla.suse.com/1274071","tags":["report"]},{"url":"https://bugzilla.suse.com/1274264","tags":["report"]},{"url":"https://bugzilla.suse.com/1274267","tags":["report"]},{"url":"https://bugzilla.suse.com/1274295","tags":["report"]},{"url":"https://bugzilla.suse.com/1274783","tags":["report"]},{"url":"https://bugzilla.suse.com/1274835","tags":["report"]},{"url":"https://bugzilla.suse.com/1274849","tags":["report"]},{"url":"https://bugzilla.suse.com/1274877","tags":["report"]},{"url":"https://bugzilla.suse.com/1274895","tags":["report"]},{"url":"https://bugzilla.suse.com/1274906","tags":["report"]},{"url":"https://bugzilla.suse.com/1275081","tags":["report"]},{"url":"https://bugzilla.suse.com/1275139","tags":["report"]},{"url":"https://bugzilla.suse.com/1275141","tags":["report"]},{"url":"https://bugzilla.suse.com/1275146","tags":["report"]},{"url":"https://bugzilla.suse.com/1275148","tags":["report"]},{"url":"https://bugzilla.suse.com/1275149","tags":["report"]},{"url":"https://bugzilla.suse.com/1275156","tags":["report"]},{"url":"https://bugzilla.suse.com/1275192","tags":["report"]},{"url":"https://bugzilla.suse.com/1275300","tags":["report"]},{"url":"https://bugzilla.suse.com/1275519","tags":["report"]},{"url":"https://bugzilla.suse.com/1275557","tags":["report"]},{"url":"https://bugzilla.suse.com/1275572","tags":["report"]},{"url":"https://bugzilla.suse.com/1275656","tags":["report"]},{"url":"https://bugzilla.suse.com/1275737","tags":["report"]},{"url":"https://bugzilla.suse.com/1275789","tags":["report"]},{"url":"https://bugzilla.suse.com/1275822","tags":["report"]},{"url":"https://bugzilla.suse.com/1275823","tags":["report"]},{"url":"https://bugzilla.suse.com/1275928","tags":["report"]},{"url":"https://bugzilla.suse.com/1276552","tags":["report"]},{"url":"https://bugzilla.suse.com/1276577","tags":["report"]},{"url":"https://bugzilla.suse.com/1276912","tags":["report"]},{"url":"https://bugzilla.suse.com/1276913","tags":["report"]},{"url":"https://bugzilla.suse.com/1276944","tags":["report"]},{"url":"https://bugzilla.suse.com/1276955","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74712","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264254-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281691","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90082","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261604","tags":["report"]},{"url":"https://bugzilla.suse.com/1263072","tags":["report"]},{"url":"https://bugzilla.suse.com/1264734","tags":["report"]},{"url":"https://bugzilla.suse.com/1269000","tags":["report"]},{"url":"https://bugzilla.suse.com/1276006","tags":["report"]},{"url":"https://bugzilla.suse.com/1277254","tags":["report"]},{"url":"https://bugzilla.suse.com/1277505","tags":["report"]},{"url":"https://bugzilla.suse.com/1277571","tags":["report"]},{"url":"https://bugzilla.suse.com/1277860","tags":["report"]},{"url":"https://bugzilla.suse.com/1278088","tags":["report"]},{"url":"https://bugzilla.suse.com/1278233","tags":["report"]},{"url":"https://bugzilla.suse.com/1278236","tags":["report"]},{"url":"https://bugzilla.suse.com/1279813","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80722","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-38469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-38469","tags":["report"]},{"url":"https://git.kernel.org/linus/5a53249d149f48b558368c5338b9921b76a12f8c","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7879-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7879-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7880-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7879-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7879-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7934-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8031-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-5","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8031-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-6","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8031-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8052-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-7","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8028-8","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8052-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8074-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8074-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8126-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-36331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38517","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38654","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38655","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68734","tags":["report"]},{"url":"https://launchpad.net/bugs/2143853","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-38469","title":"KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T11:21:30.992Z","modified":"2026-05-11T21:28:36.841Z","updated_at":"2026-11-02T14:32:47.08757Z"}],"euvd":[{"id":"EUVD-2025-22893","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T11:21:30Z","modified":"2026-05-11T21:28:36Z","updated_at":"2026-11-02T19:04:48.471562Z"}],"ghsa":[{"id":"GHSA-632w-7gxq-vxq4","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T12:30:34Z","modified":"2025-11-19T18:32:22Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:04:53.049342Z"}],"nvd":[{"id":"CVE-2025-38469","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T12:15:28.64Z","modified":"2026-06-17T09:16:55.383Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"BELL-CVE-2025-38469","status":"published","published":"2025-07-29T06:02:22.535626Z","modified":"2026-06-25T07:18:28.698998055Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.997209Z"},{"id":"DEBIAN-CVE-2025-38469","description":"In the Linux kernel, the following vulnerability has been resolved:  KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls  kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports \u003e 1).  After the kmalloc_array(), the error paths need to go through the \"out\" label, but the call to kvm_read_guest_virt() does not.  [Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T12:15:28.64Z","modified":"2026-09-01T20:05:48.973150005Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:46.626332Z"},{"id":"UBUNTU-CVE-2025-38469","description":"In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports \u003e 1). After the kmalloc_array(), the error paths need to go through the \"out\" label, but the call to kvm_read_guest_virt() does not. [Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T12:15:00Z","modified":"2026-11-03T14:37:23.156491758Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T15:14:56.096419Z"},{"id":"CVE-2025-38469","title":"KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]","status":"published","published":"2025-07-28T11:21:30.992Z","modified":"2026-10-28T02:30:32.825524448Z","updated_at":"2026-11-02T15:44:48.703031Z"},{"id":"DSA-5975-1","title":"linux - security update","status":"published","published":"2025-08-13T00:00:00Z","modified":"2026-03-09T02:08:47.403355Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0218","title":"Updated kernel-linus packages fix security vulnerabilities","description":"Vanilla upstream kernel version 6.6.101 fixes bugs and vulnerabilities.\nFor information about the vulnerabilities see the links.\n","status":"published","published":"2025-08-11T22:03:41Z","modified":"2026-04-16T04:44:21.837228825Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"MGASA-2025-0219","title":"Updated kernel, kmod-virtualbox, kmod-xtables-addons \u0026 wireless-regdb packages fix security vulnerabilities","description":"Upstream kernel version 6.6.101 fixes bugs and vulnerabilities.\nThe kmod-virtualbox, kmod-xtables-addons \u0026 wireless-regdb packages have\nbeen updated to work with this new kernel.\nFor information about the vulnerabilities see the links.\n","status":"published","published":"2025-08-11T22:03:41Z","modified":"2026-04-16T04:42:44.215856089Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:21555-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-12T01:09:28Z","modified":"2026-08-12T17:45:23.234348653Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-38469","title":"CVE-2025-38469 in linux - Patched by Root","description":"Root has patched CVE-2025-38469 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:16:50.50337229Z","updated_at":"2026-11-06T16:59:12.581242Z"},{"id":"SUSE-SU-2026:23066-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T20:56:24Z","modified":"2026-08-15T18:23:51.257464779Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23068-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-15T18:23:51.243537972Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23193-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).\n- CVE-2025-68818: scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\" (bsc#1256675).\n- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov-\u003einit() fails (bsc#1264832).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).\n- CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46294: dm: fix a buffer overflow in ioctl processing (bsc#1267939).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-52910: pf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: rculist: add list_splice_rcu() for private lists (bsc#1269362).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53345: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (bsc#1270132).\n- CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs\" (bsc#1270230).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: Don't reset the write verifier on a commit EAGAIN (bsc#1271858).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912 bsc#1273004).\n- CVE-2026-64561: kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: make BYTES_TO_BITS() treewide-available (stable-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware_loader: introduce __free() cleanup hanler (stable-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).\n- ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).\n- ice: fix PTP Call Trace during PTP release (bsc#1269981).\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).\n- ice: introduce PTP state machine (bsc#1269981).\n- ice: pass reset type to PTP reset functions (bsc#1269981).\n- ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).\n- ice: rename verify_cached to has_ready_bitmap (bsc#1269981).\n- ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes).\n- Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes).\n- Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).\n- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: convert pagecache_isize_extended to use a folio (bsc#1272920).\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: Add a helper for calculating a page index (stable-fixes).\n- mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- platform/x86: dell-smbios: Move request functions for reuse (stable-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- sctp: validate embedded address parameter length (git-fixes).\n- selftests/alsa: Fix memory leak in find_controls error path (git-fixes).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_mid: Remove 8250_pci usage (stable-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- slimbus: Convert to platform remove callback returning void (stable-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n","status":"published","published":"2026-08-18T18:56:11Z","modified":"2026-08-26T18:23:31.192781835Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23194-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).\n- CVE-2025-68818: scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\" (bsc#1256675).\n- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov-\u003einit() fails (bsc#1264832).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46056: kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).\n- CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46294: dm: fix a buffer overflow in ioctl processing (bsc#1267939).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-52910: pf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: rculist: add list_splice_rcu() for private lists (bsc#1269362).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).\n- CVE-2026-53345: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (bsc#1270132).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: Don't reset the write verifier on a commit EAGAIN (bsc#1271858).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: make BYTES_TO_BITS() treewide-available (stable-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware_loader: introduce __free() cleanup hanler (stable-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).\n- ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).\n- ice: fix PTP Call Trace during PTP release (bsc#1269981).\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).\n- ice: introduce PTP state machine (bsc#1269981).\n- ice: pass reset type to PTP reset functions (bsc#1269981).\n- ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).\n- ice: rename verify_cached to has_ready_bitmap (bsc#1269981).\n- ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes).\n- Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes).\n- Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).\n- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: convert pagecache_isize_extended to use a folio (bsc#1272920).\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: Add a helper for calculating a page index (stable-fixes).\n- mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- platform/x86: dell-smbios: Move request functions for reuse (stable-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- sctp: validate embedded address parameter length (git-fixes).\n- selftests/alsa: Fix memory leak in find_controls error path (git-fixes).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_mid: Remove 8250_pci usage (stable-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- slimbus: Convert to platform remove callback returning void (stable-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n","status":"published","published":"2026-08-18T19:48:07Z","modified":"2026-08-26T18:23:31.191966055Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23221-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-27T18:23:09.328001936Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23231-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-27T18:23:10.279362294Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23237-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:34:22Z","modified":"2026-08-27T18:23:10.81084318Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23241-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).\n- CVE-2025-68818: scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\" (bsc#1256675).\n- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov-\u003einit() fails (bsc#1264832).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).\n- CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46294: dm: fix a buffer overflow in ioctl processing (bsc#1267939).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-52910: pf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: rculist: add list_splice_rcu() for private lists (bsc#1269362).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53345: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (bsc#1270132).\n- CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs\" (bsc#1270230).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: Don't reset the write verifier on a commit EAGAIN (bsc#1271858).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912 bsc#1273004).\n- CVE-2026-64561: kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: make BYTES_TO_BITS() treewide-available (stable-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware_loader: introduce __free() cleanup hanler (stable-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).\n- ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).\n- ice: fix PTP Call Trace during PTP release (bsc#1269981).\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).\n- ice: introduce PTP state machine (bsc#1269981).\n- ice: pass reset type to PTP reset functions (bsc#1269981).\n- ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).\n- ice: rename verify_cached to has_ready_bitmap (bsc#1269981).\n- ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes).\n- Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes).\n- Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).\n- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: convert pagecache_isize_extended to use a folio (bsc#1272920).\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: Add a helper for calculating a page index (stable-fixes).\n- mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- platform/x86: dell-smbios: Move request functions for reuse (stable-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- sctp: validate embedded address parameter length (git-fixes).\n- selftests/alsa: Fix memory leak in find_controls error path (git-fixes).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_mid: Remove 8250_pci usage (stable-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- slimbus: Convert to platform remove callback returning void (stable-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n","status":"published","published":"2026-08-18T20:43:06Z","modified":"2026-08-27T18:23:10.808564589Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23244-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).\n- CVE-2025-68818: scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\" (bsc#1256675).\n- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov-\u003einit() fails (bsc#1264832).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46056: kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).\n- CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46294: dm: fix a buffer overflow in ioctl processing (bsc#1267939).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-52910: pf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: rculist: add list_splice_rcu() for private lists (bsc#1269362).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).\n- CVE-2026-53345: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (bsc#1270132).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: Don't reset the write verifier on a commit EAGAIN (bsc#1271858).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: make BYTES_TO_BITS() treewide-available (stable-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware_loader: introduce __free() cleanup hanler (stable-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).\n- ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).\n- ice: fix PTP Call Trace during PTP release (bsc#1269981).\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).\n- ice: introduce PTP state machine (bsc#1269981).\n- ice: pass reset type to PTP reset functions (bsc#1269981).\n- ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).\n- ice: rename verify_cached to has_ready_bitmap (bsc#1269981).\n- ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes).\n- Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes).\n- Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).\n- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: convert pagecache_isize_extended to use a folio (bsc#1272920).\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: Add a helper for calculating a page index (stable-fixes).\n- mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- platform/x86: dell-smbios: Move request functions for reuse (stable-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- sctp: validate embedded address parameter length (git-fixes).\n- selftests/alsa: Fix memory leak in find_controls error path (git-fixes).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_mid: Remove 8250_pci usage (stable-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- slimbus: Convert to platform remove callback returning void (stable-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n","status":"published","published":"2026-08-18T20:52:35Z","modified":"2026-08-27T18:23:11.288656489Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23477-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T12:54:32Z","modified":"2026-09-14T18:23:16.721468657Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23481-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731) \t  \n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T13:00:49Z","modified":"2026-09-14T18:23:13.340667208Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23528-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T10:34:26Z","modified":"2026-09-15T18:23:09.824440367Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23529-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731) \t  \n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T11:00:17Z","modified":"2026-09-15T18:23:09.921123083Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3790-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).\n- CVE-2025-68818: scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in abort path' (bsc#1256675).\n- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov-\u003einit() fails (bsc#1264832).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).\n- CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-52910: pf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: rculist: add list_splice_rcu() for private lists (bsc#1269362).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53345: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (bsc#1270132).\n- CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).    \n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: Don't reset the write verifier on a commit EAGAIN (bsc#1271858).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63938: KVM: SEV: Check PSC request indices against the actual size of the buffer (bsc#1272620).\n- CVE-2026-63939: KVM: SEV: Compute the correct max length of the in-GHCB scratch area (bsc#1272691).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: make BYTES_TO_BITS() treewide-available (stable-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware_loader: introduce __free() cleanup hanler (stable-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).\n- ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).\n- ice: fix PTP Call Trace during PTP release (bsc#1269981).\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).\n- ice: introduce PTP state machine (bsc#1269981).\n- ice: pass reset type to PTP reset functions (bsc#1269981).\n- ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).\n- ice: rename verify_cached to has_ready_bitmap (bsc#1269981).\n- ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes).\n- Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes).\n- Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (bsc#1271283).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (bsc#1271285).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).\n- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).\n- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- libbpf: Search /lib64 and /lib in resolve_full_path() (bsc#1271250).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: convert pagecache_isize_extended to use a folio (bsc#1272920).\n- mm: fix the inaccurate memory statistics issue for users (bsc#1268648).\n- mm: list_lru: disable memcg_aware when cgroup.memory is set to 'nokmem' (bsc#1271402).\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: Add a helper for calculating a page index (stable-fixes).\n- mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging '(null)' for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- platform/x86: dell-smbios: Move request functions for reuse (stable-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert 'Input: rmi4 - fix register descriptor address calculation' (stable-fixes).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- sctp: validate embedded address parameter length (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_mid: Remove 8250_pci usage (stable-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- series.conf: disable failing patch.\n- slimbus: Convert to platform remove callback returning void (stable-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- task_work: Fix NMI race condition (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n","status":"published","published":"2026-08-25T12:24:44Z","modified":"2026-08-27T11:01:49.764430332Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3810-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).\n- CVE-2025-68818: scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in abort path' (bsc#1256675).\n- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov-\u003einit() fails (bsc#1264832).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).\n- CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-52910: pf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: rculist: add list_splice_rcu() for private lists (bsc#1269362).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53345: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (bsc#1270132).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: Don't reset the write verifier on a commit EAGAIN (bsc#1271858).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (bsc#1272268).\n- CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (bsc#1272263).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63938: KVM: SEV: Check PSC request indices against the actual size of the buffer (bsc#1272620).\n- CVE-2026-63939: KVM: SEV: Compute the correct max length of the in-GHCB scratch area (bsc#1272691).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: make BYTES_TO_BITS() treewide-available (stable-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware_loader: introduce __free() cleanup hanler (stable-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).\n- ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).\n- ice: fix PTP Call Trace during PTP release (bsc#1269981).\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).\n- ice: introduce PTP state machine (bsc#1269981).\n- ice: pass reset type to PTP reset functions (bsc#1269981).\n- ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).\n- ice: rename verify_cached to has_ready_bitmap (bsc#1269981).\n- ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes).\n- Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes).\n- Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (bsc#1271283).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (bsc#1271285).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).\n- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).\n- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- libbpf: Search /lib64 and /lib in resolve_full_path() (bsc#1271250).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: convert pagecache_isize_extended to use a folio (bsc#1272920).\n- mm: fix the inaccurate memory statistics issue for users (bsc#1268648).\n- mm: list_lru: disable memcg_aware when cgroup.memory is set to 'nokmem' (bsc#1271402).\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: Add a helper for calculating a page index (stable-fixes).\n- mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging '(null)' for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- platform/x86: dell-smbios: Move request functions for reuse (stable-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).\n- posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).\n- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).\n- posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).\n- posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).\n- posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).\n- posix-timers: Clear overrun in common_timer_set() (bsc#1271912).\n- posix-timers: Consolidate signal queueing (bsc#1271912).\n- posix-timers: Consolidate timer setup (bsc#1271912).\n- posix-timers: Cure si_sys_private race (bsc#1271912).\n- posix-timers: Document common_clock_get() correctly (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- posix-timers: Polish coding style in a few places (bsc#1271912).\n- posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert 'Input: rmi4 - fix register descriptor address calculation' (stable-fixes).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- sctp: validate embedded address parameter length (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_mid: Remove 8250_pci usage (stable-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- series.conf: disable failing patch.\n- slimbus: Convert to platform remove callback returning void (stable-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- task_work: Fix NMI race condition (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n","status":"published","published":"2026-08-26T10:47:00Z","modified":"2026-08-31T18:23:10.118258948Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4120-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).\n- CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64055: net: ethernet: cortina: Drop half-assembled SKB (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502 bsc#1272893).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64136: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (bsc#1272351).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64515: wifi: mac80211: fix MLE defragmentation (bsc#1273859).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72498: RDMA/bnxt_re: Avoid displaying the kernel pointer (bsc#1276912).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- arm64: Exclude nohz_full CPUs from 32bits el0 support (bsc#1269313).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Adjust TX rings if reservation is less than requested (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- kthread: Default affine kthread to its preferred NUMA node (bsc#1269313).\n- kthread: Make sure kthread hasn't started while binding it (bsc#1269313).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mm: Create/affine kcompactd to its preferred node (bsc#1269313).\n- mm: Create/affine kswapd to its preferred node (bsc#1269313).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).\n- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).\n- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- sched,arm64: Handle CPU isolation on last resort fallback rq (bsc#1269313).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uaccess: add copy_struct_to_user helper (bsc#1263864 ltc#217835).\n- uaccess: fix ignored_trailing logic in copy_struct_to_user() (bsc#1263864 ltc#217835).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (bsc#1240957 bsc#1249104 bsc#1265220).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-10T09:31:34Z","modified":"2026-09-14T18:23:14.868358938Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4254-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64055,CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502 bsc#1272893).\n- CVE-2026-64055: net: ethernet: cortina: Drop half-assembled SKB (bsc#1272893).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64136: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (bsc#1272351).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64515: wifi: mac80211: fix MLE defragmentation (bsc#1273859).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72498: RDMA/bnxt_re: Avoid displaying the kernel pointer (bsc#1276912).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n- CVE-2026-90082: net: mana: Cap MSI-X vectors to the device MSI-X table size \n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- arm64: Exclude nohz_full CPUs from 32bits el0 support (bsc#1269313).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Adjust TX rings if reservation is less than requested (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- kthread: Default affine kthread to its preferred NUMA node (bsc#1269313).\n- kthread: Make sure kthread hasn't started while binding it (bsc#1269313).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mm: Create/affine kcompactd to its preferred node (bsc#1269313).\n- mm: Create/affine kswapd to its preferred node (bsc#1269313).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).\n- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).\n- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- sched,arm64: Handle CPU isolation on last resort fallback rq (bsc#1269313).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uaccess: add copy_struct_to_user helper (bsc#1263864 ltc#217835).\n- uaccess: fix ignored_trailing logic in copy_struct_to_user() (bsc#1263864 ltc#217835).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (bsc#1240957 bsc#1249104 bsc#1265220).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-10-07T22:31:36Z","modified":"2026-10-08T19:27:38.397282936Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4369-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n\nThe following non security issues were fixed:\n\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n","status":"published","published":"2026-10-02T12:46:28Z","modified":"2026-10-02T18:42:50.599983491Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-7879-1","title":"linux, linux-aws, linux-gcp, linux-hwe-6.14, linux-oracle, linux-realtime vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Network block device driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - ASPEED SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - USB Gadget drivers;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - File systems infrastructure;\n  - F2FS file system;\n  - GFS2 file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - io_uring subsystem;\n  - Internal shared memory driver;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - UDP network protocol;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - Codetag library;\n  - KASAN memory debugging framework;\n  - Memory management;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - XFRM subsystem;\n  - ADI SoundPort AD1816A based soundcard drivers;\n  - MediaTek ASoC drivers;\n  - SOF drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437,\nCVE-2025-38438, CVE-2025-38439, CVE-2025-38440, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38446,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451,\nCVE-2025-38452, CVE-2025-38453, CVE-2025-38454, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475,\nCVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481,\nCVE-2025-38482, CVE-2025-38483, CVE-2025-38484, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38492, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38508, CVE-2025-38509, CVE-2025-38510, CVE-2025-38511,\nCVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515,\nCVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38525, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38545,\nCVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38556, CVE-2025-38557, CVE-2025-38558,\nCVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38563, CVE-2025-38565, CVE-2025-38566, CVE-2025-38567,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38570, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38605, CVE-2025-38606,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38615, CVE-2025-38616, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38642, CVE-2025-38643, CVE-2025-38644,\nCVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649,\nCVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38654,\nCVE-2025-38655, CVE-2025-38659, CVE-2025-38660, CVE-2025-38662,\nCVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666,\nCVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675,\nCVE-2025-38678, CVE-2025-39725, CVE-2025-39726, CVE-2025-39727,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39809, CVE-2025-39818, CVE-2025-40157)\n","status":"published","published":"2025-11-21T15:26:39Z","modified":"2026-06-03T13:35:25.81509537Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7879-2","title":"linux-realtime-6.14 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Network block device driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - ASPEED SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - USB Gadget drivers;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - File systems infrastructure;\n  - F2FS file system;\n  - GFS2 file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - io_uring subsystem;\n  - Internal shared memory driver;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - UDP network protocol;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - Codetag library;\n  - KASAN memory debugging framework;\n  - Memory management;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - XFRM subsystem;\n  - ADI SoundPort AD1816A based soundcard drivers;\n  - MediaTek ASoC drivers;\n  - SOF drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437,\nCVE-2025-38438, CVE-2025-38439, CVE-2025-38440, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38446,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451,\nCVE-2025-38452, CVE-2025-38453, CVE-2025-38454, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475,\nCVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481,\nCVE-2025-38482, CVE-2025-38483, CVE-2025-38484, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38492, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38508, CVE-2025-38509, CVE-2025-38510, CVE-2025-38511,\nCVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515,\nCVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38525, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38545,\nCVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38556, CVE-2025-38557, CVE-2025-38558,\nCVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38563, CVE-2025-38565, CVE-2025-38566, CVE-2025-38567,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38570, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38605, CVE-2025-38606,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38615, CVE-2025-38616, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38642, CVE-2025-38643, CVE-2025-38644,\nCVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649,\nCVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38654,\nCVE-2025-38655, CVE-2025-38659, CVE-2025-38660, CVE-2025-38662,\nCVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666,\nCVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675,\nCVE-2025-38678, CVE-2025-39725, CVE-2025-39726, CVE-2025-39727,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39809, CVE-2025-39818, CVE-2025-40157)\n","status":"published","published":"2025-11-21T15:45:02Z","modified":"2026-11-03T14:33:58.968823468Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7879-3","title":"linux-aws-6.14, linux-oracle-6.14 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Network block device driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - ASPEED SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - USB Gadget drivers;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - File systems infrastructure;\n  - F2FS file system;\n  - GFS2 file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - io_uring subsystem;\n  - Internal shared memory driver;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - UDP network protocol;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - Codetag library;\n  - KASAN memory debugging framework;\n  - Memory management;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - XFRM subsystem;\n  - ADI SoundPort AD1816A based soundcard drivers;\n  - MediaTek ASoC drivers;\n  - SOF drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437,\nCVE-2025-38438, CVE-2025-38439, CVE-2025-38440, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38446,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451,\nCVE-2025-38452, CVE-2025-38453, CVE-2025-38454, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475,\nCVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481,\nCVE-2025-38482, CVE-2025-38483, CVE-2025-38484, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38492, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38508, CVE-2025-38509, CVE-2025-38510, CVE-2025-38511,\nCVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515,\nCVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38525, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38545,\nCVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38556, CVE-2025-38557, CVE-2025-38558,\nCVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38563, CVE-2025-38565, CVE-2025-38566, CVE-2025-38567,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38570, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38605, CVE-2025-38606,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38615, CVE-2025-38616, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38642, CVE-2025-38643, CVE-2025-38644,\nCVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649,\nCVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38654,\nCVE-2025-38655, CVE-2025-38659, CVE-2025-38660, CVE-2025-38662,\nCVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666,\nCVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675,\nCVE-2025-38678, CVE-2025-39725, CVE-2025-39726, CVE-2025-39727,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39809, CVE-2025-39818, CVE-2025-40157)\n","status":"published","published":"2025-11-26T08:34:26Z","modified":"2026-11-03T14:34:02.86690422Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7879-4","title":"linux-gcp-6.14, linux-raspi vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Network block device driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - ASPEED SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - USB Gadget drivers;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - File systems infrastructure;\n  - F2FS file system;\n  - GFS2 file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - io_uring subsystem;\n  - Internal shared memory driver;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - UDP network protocol;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - Codetag library;\n  - KASAN memory debugging framework;\n  - Memory management;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - XFRM subsystem;\n  - ADI SoundPort AD1816A based soundcard drivers;\n  - MediaTek ASoC drivers;\n  - SOF drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437,\nCVE-2025-38438, CVE-2025-38439, CVE-2025-38440, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38446,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451,\nCVE-2025-38452, CVE-2025-38453, CVE-2025-38454, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475,\nCVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481,\nCVE-2025-38482, CVE-2025-38483, CVE-2025-38484, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38492, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38508, CVE-2025-38509, CVE-2025-38510, CVE-2025-38511,\nCVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515,\nCVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38525, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38545,\nCVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38556, CVE-2025-38557, CVE-2025-38558,\nCVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38563, CVE-2025-38565, CVE-2025-38566, CVE-2025-38567,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38570, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38605, CVE-2025-38606,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38615, CVE-2025-38616, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38642, CVE-2025-38643, CVE-2025-38644,\nCVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649,\nCVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38654,\nCVE-2025-38655, CVE-2025-38659, CVE-2025-38660, CVE-2025-38662,\nCVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666,\nCVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675,\nCVE-2025-38678, CVE-2025-39725, CVE-2025-39726, CVE-2025-39727,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39809, CVE-2025-39818, CVE-2025-40157)\n","status":"published","published":"2025-12-04T10:22:14Z","modified":"2026-11-03T14:34:04.402703108Z","updated_at":"2026-11-03T15:17:11.325641Z"},{"id":"USN-7880-1","title":"linux-oem-6.14 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Network block device driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - ASPEED SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - USB Gadget drivers;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - File systems infrastructure;\n  - F2FS file system;\n  - GFS2 file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - io_uring subsystem;\n  - Internal shared memory driver;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - UDP network protocol;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - Codetag library;\n  - KASAN memory debugging framework;\n  - Memory management;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - XFRM subsystem;\n  - ADI SoundPort AD1816A based soundcard drivers;\n  - MediaTek ASoC drivers;\n  - SOF drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437,\nCVE-2025-38438, CVE-2025-38439, CVE-2025-38440, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38446,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451,\nCVE-2025-38452, CVE-2025-38453, CVE-2025-38454, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475,\nCVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481,\nCVE-2025-38482, CVE-2025-38483, CVE-2025-38484, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38492, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38508, CVE-2025-38509, CVE-2025-38510, CVE-2025-38511,\nCVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515,\nCVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38525, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38545,\nCVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38556, CVE-2025-38557, CVE-2025-38558,\nCVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38563, CVE-2025-38565, CVE-2025-38566, CVE-2025-38567,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38570, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38605, CVE-2025-38606,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38615, CVE-2025-38616, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38642, CVE-2025-38643, CVE-2025-38644,\nCVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649,\nCVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38654,\nCVE-2025-38655, CVE-2025-38659, CVE-2025-38660, CVE-2025-38662,\nCVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666,\nCVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675,\nCVE-2025-38678, CVE-2025-39725, CVE-2025-39726, CVE-2025-39727,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734)\n","status":"published","published":"2025-11-21T15:57:32Z","modified":"2026-11-03T14:34:00.62137189Z","updated_at":"2026-11-03T15:17:16.577329Z"},{"id":"USN-7934-1","title":"linux-azure, linux-azure-6.14 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nJean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered\nthat the Linux kernel contained insufficient branch predictor isolation\nbetween a guest and a userspace hypervisor for certain processors. This\nflaw is known as VMSCAPE. An attacker in a guest VM could possibly use this\nto expose sensitive information from the host OS. (CVE-2025-40300)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Network block device driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - ASPEED SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - USB Gadget drivers;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - File systems infrastructure;\n  - F2FS file system;\n  - GFS2 file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - io_uring subsystem;\n  - Internal shared memory driver;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - UDP network protocol;\n  - Tracing infrastructure;\n  - BPF subsystem;\n  - Perf events;\n  - Padata parallel execution mechanism;\n  - Codetag library;\n  - KASAN memory debugging framework;\n  - Memory management;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - XFRM subsystem;\n  - ADI SoundPort AD1816A based soundcard drivers;\n  - MediaTek ASoC drivers;\n  - SOF drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437,\nCVE-2025-38438, CVE-2025-38439, CVE-2025-38440, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38446,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451,\nCVE-2025-38452, CVE-2025-38453, CVE-2025-38454, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475,\nCVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481,\nCVE-2025-38482, CVE-2025-38483, CVE-2025-38484, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38492, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38508, CVE-2025-38509, CVE-2025-38510, CVE-2025-38511,\nCVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515,\nCVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38525, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38545,\nCVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38556, CVE-2025-38557, CVE-2025-38558,\nCVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38563, CVE-2025-38565, CVE-2025-38566, CVE-2025-38567,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38570, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38605, CVE-2025-38606,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38615, CVE-2025-38616, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38642, CVE-2025-38643, CVE-2025-38644,\nCVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649,\nCVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38654,\nCVE-2025-38655, CVE-2025-38659, CVE-2025-38660, CVE-2025-38662,\nCVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666,\nCVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675,\nCVE-2025-38678, CVE-2025-39725, CVE-2025-39726, CVE-2025-39727,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39809, CVE-2025-39818, CVE-2025-39946, CVE-2025-39964,\nCVE-2025-39993, CVE-2025-40018, CVE-2025-40157)\n","status":"published","published":"2025-12-15T20:51:05Z","modified":"2026-11-03T14:34:22.418957954Z","updated_at":"2026-11-03T15:17:04.783338Z"},{"id":"USN-8028-1","title":"linux, linux-raspi vulnerabilities","description":"\nIt was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-11T16:39:10Z","modified":"2026-11-03T14:34:46.341804014Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8028-2","title":"linux-realtime-6.8 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-12T09:57:11Z","modified":"2026-11-03T14:34:35.34044986Z","updated_at":"2026-11-03T15:16:59.562266Z"},{"id":"USN-8028-3","title":"linux-realtime, linux-raspi-realtime vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-17T14:03:27Z","modified":"2026-11-03T14:34:45.712363126Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8028-4","title":"linux-aws-fips, linux-fips vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-17T14:41:16Z","modified":"2026-11-03T14:34:46.888176267Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8028-5","title":"linux-aws, linux-aws-6.8, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-17T15:38:25Z","modified":"2026-11-03T14:38:15.5301337Z","updated_at":"2026-11-03T15:14:17.286738Z"},{"id":"USN-8028-6","title":"linux-hwe-6.8, linux-lowlatency-hwe-6.8 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-19T09:01:52Z","modified":"2026-11-03T14:35:19.673991765Z","updated_at":"2026-11-03T15:16:22.507285Z"},{"id":"USN-8028-7","title":"linux-nvidia-lowlatency vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-19T12:29:23Z","modified":"2026-11-03T14:34:35.33102093Z","updated_at":"2026-11-03T15:16:59.562266Z"},{"id":"USN-8028-8","title":"linux-ibm, linux-ibm-6.8 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-24T18:36:08Z","modified":"2026-11-03T14:35:22.59799177Z","updated_at":"2026-11-03T15:16:18.473448Z"},{"id":"USN-8031-1","title":"linux-gcp-6.8 vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429,\nCVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439,\nCVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456,\nCVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460,\nCVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,\nCVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468,\nCVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472,\nCVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478,\nCVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,\nCVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489,\nCVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499,\nCVE-2025-38501, CVE-2025-38503, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513,\nCVE-2025-38514, CVE-2025-38515, CVE-2025-38516, CVE-2025-38520,\nCVE-2025-38521, CVE-2025-38524, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38535, CVE-2025-38537,\nCVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542,\nCVE-2025-38543, CVE-2025-38544, CVE-2025-38546, CVE-2025-38548,\nCVE-2025-38549, CVE-2025-38550, CVE-2025-38551, CVE-2025-38552,\nCVE-2025-38553, CVE-2025-38555, CVE-2025-38560, CVE-2025-38562,\nCVE-2025-38566, CVE-2025-38568, CVE-2025-38569, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,\nCVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582,\nCVE-2025-38583, CVE-2025-38584, CVE-2025-38585, CVE-2025-38587,\nCVE-2025-38588, CVE-2025-38590, CVE-2025-38593, CVE-2025-38595,\nCVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38608,\nCVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38614,\nCVE-2025-38615, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623,\nCVE-2025-38624, CVE-2025-38625, CVE-2025-38626, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38644, CVE-2025-38645, CVE-2025-38646,\nCVE-2025-38648, CVE-2025-38650, CVE-2025-38652, CVE-2025-38653,\nCVE-2025-38659, CVE-2025-38660, CVE-2025-38663, CVE-2025-38664,\nCVE-2025-38665, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671,\nCVE-2025-38675, CVE-2025-38676, CVE-2025-38677, CVE-2025-38679,\nCVE-2025-38680, CVE-2025-38681, CVE-2025-38683, CVE-2025-38684,\nCVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688,\nCVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694,\nCVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698,\nCVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702,\nCVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706,\nCVE-2025-38707, CVE-2025-38708, CVE-2025-38710, CVE-2025-38711,\nCVE-2025-38712, CVE-2025-38713, CVE-2025-38714, CVE-2025-38715,\nCVE-2025-38716, CVE-2025-38718, CVE-2025-38721, CVE-2025-38722,\nCVE-2025-38724, CVE-2025-38725, CVE-2025-38728, CVE-2025-38729,\nCVE-2025-38730, CVE-2025-38732, CVE-2025-38734, CVE-2025-38735,\nCVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39679,\nCVE-2025-39681, CVE-2025-39683, CVE-2025-39684, CVE-2025-39685,\nCVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691,\nCVE-2025-39692, CVE-2025-39693, CVE-2025-39694, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39889, CVE-2025-39890,\nCVE-2025-39946, CVE-2025-39989, CVE-2025-40215, CVE-2025-40297,\nCVE-2025-68750)\n","status":"published","published":"2026-02-12T10:13:02Z","modified":"2026-11-03T14:34:33.889553261Z","updated_at":"2026-11-03T15:16:59.562266Z"},{"id":"USN-8031-2","title":"linux-gcp-fips vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429,\nCVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439,\nCVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456,\nCVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460,\nCVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,\nCVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468,\nCVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472,\nCVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478,\nCVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,\nCVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489,\nCVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499,\nCVE-2025-38501, CVE-2025-38503, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513,\nCVE-2025-38514, CVE-2025-38515, CVE-2025-38516, CVE-2025-38520,\nCVE-2025-38521, CVE-2025-38524, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38535, CVE-2025-38537,\nCVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542,\nCVE-2025-38543, CVE-2025-38544, CVE-2025-38546, CVE-2025-38548,\nCVE-2025-38549, CVE-2025-38550, CVE-2025-38551, CVE-2025-38552,\nCVE-2025-38553, CVE-2025-38555, CVE-2025-38560, CVE-2025-38562,\nCVE-2025-38566, CVE-2025-38568, CVE-2025-38569, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,\nCVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582,\nCVE-2025-38583, CVE-2025-38584, CVE-2025-38585, CVE-2025-38587,\nCVE-2025-38588, CVE-2025-38590, CVE-2025-38593, CVE-2025-38595,\nCVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38608,\nCVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38614,\nCVE-2025-38615, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623,\nCVE-2025-38624, CVE-2025-38625, CVE-2025-38626, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38644, CVE-2025-38645, CVE-2025-38646,\nCVE-2025-38648, CVE-2025-38650, CVE-2025-38652, CVE-2025-38653,\nCVE-2025-38659, CVE-2025-38660, CVE-2025-38663, CVE-2025-38664,\nCVE-2025-38665, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671,\nCVE-2025-38675, CVE-2025-38676, CVE-2025-38677, CVE-2025-38679,\nCVE-2025-38680, CVE-2025-38681, CVE-2025-38683, CVE-2025-38684,\nCVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688,\nCVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694,\nCVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698,\nCVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702,\nCVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706,\nCVE-2025-38707, CVE-2025-38708, CVE-2025-38710, CVE-2025-38711,\nCVE-2025-38712, CVE-2025-38713, CVE-2025-38714, CVE-2025-38715,\nCVE-2025-38716, CVE-2025-38718, CVE-2025-38721, CVE-2025-38722,\nCVE-2025-38724, CVE-2025-38725, CVE-2025-38728, CVE-2025-38729,\nCVE-2025-38730, CVE-2025-38732, CVE-2025-38734, CVE-2025-38735,\nCVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39679,\nCVE-2025-39681, CVE-2025-39683, CVE-2025-39684, CVE-2025-39685,\nCVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691,\nCVE-2025-39692, CVE-2025-39693, CVE-2025-39694, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39889, CVE-2025-39890,\nCVE-2025-39946, CVE-2025-39989, CVE-2025-40215, CVE-2025-40297,\nCVE-2025-68750)\n","status":"published","published":"2026-02-18T10:06:54Z","modified":"2026-11-03T14:34:34.813034883Z","updated_at":"2026-11-03T15:16:59.562266Z"},{"id":"USN-8031-3","title":"linux-gcp, linux-gke vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429,\nCVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439,\nCVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456,\nCVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460,\nCVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,\nCVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468,\nCVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472,\nCVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478,\nCVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,\nCVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489,\nCVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499,\nCVE-2025-38501, CVE-2025-38503, CVE-2025-38506, CVE-2025-38507,\nCVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513,\nCVE-2025-38514, CVE-2025-38515, CVE-2025-38516, CVE-2025-38520,\nCVE-2025-38521, CVE-2025-38524, CVE-2025-38526, CVE-2025-38527,\nCVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531,\nCVE-2025-38532, CVE-2025-38533, CVE-2025-38535, CVE-2025-38537,\nCVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542,\nCVE-2025-38543, CVE-2025-38544, CVE-2025-38546, CVE-2025-38548,\nCVE-2025-38549, CVE-2025-38550, CVE-2025-38551, CVE-2025-38552,\nCVE-2025-38553, CVE-2025-38555, CVE-2025-38560, CVE-2025-38562,\nCVE-2025-38566, CVE-2025-38568, CVE-2025-38569, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,\nCVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582,\nCVE-2025-38583, CVE-2025-38584, CVE-2025-38585, CVE-2025-38587,\nCVE-2025-38588, CVE-2025-38590, CVE-2025-38593, CVE-2025-38595,\nCVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38608,\nCVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38614,\nCVE-2025-38615, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623,\nCVE-2025-38624, CVE-2025-38625, CVE-2025-38626, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38644, CVE-2025-38645, CVE-2025-38646,\nCVE-2025-38648, CVE-2025-38650, CVE-2025-38652, CVE-2025-38653,\nCVE-2025-38659, CVE-2025-38660, CVE-2025-38663, CVE-2025-38664,\nCVE-2025-38665, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671,\nCVE-2025-38675, CVE-2025-38676, CVE-2025-38677, CVE-2025-38679,\nCVE-2025-38680, CVE-2025-38681, CVE-2025-38683, CVE-2025-38684,\nCVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688,\nCVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694,\nCVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698,\nCVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702,\nCVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706,\nCVE-2025-38707, CVE-2025-38708, CVE-2025-38710, CVE-2025-38711,\nCVE-2025-38712, CVE-2025-38713, CVE-2025-38714, CVE-2025-38715,\nCVE-2025-38716, CVE-2025-38718, CVE-2025-38721, CVE-2025-38722,\nCVE-2025-38724, CVE-2025-38725, CVE-2025-38728, CVE-2025-38729,\nCVE-2025-38730, CVE-2025-38732, CVE-2025-38734, CVE-2025-38735,\nCVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39679,\nCVE-2025-39681, CVE-2025-39683, CVE-2025-39684, CVE-2025-39685,\nCVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691,\nCVE-2025-39692, CVE-2025-39693, CVE-2025-39694, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39889, CVE-2025-39890,\nCVE-2025-39946, CVE-2025-39989, CVE-2025-40215, CVE-2025-40297,\nCVE-2025-68750)\n","status":"published","published":"2026-02-19T09:26:23Z","modified":"2026-11-03T14:34:47.042824298Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8052-1","title":"linux-lowlatency vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-19T09:51:06Z","modified":"2026-11-03T14:35:12.915366191Z","updated_at":"2026-11-03T15:16:30.201391Z"},{"id":"USN-8052-2","title":"linux-xilinx vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37954, CVE-2025-37956,\nCVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961,\nCVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968,\nCVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973,\nCVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979,\nCVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984,\nCVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988,\nCVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992,\nCVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003,\nCVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007,\nCVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011,\nCVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018,\nCVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024,\nCVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035,\nCVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043,\nCVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051,\nCVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057,\nCVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061,\nCVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066,\nCVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072,\nCVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078,\nCVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084,\nCVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088,\nCVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095,\nCVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100,\nCVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38244, CVE-2025-38245,\nCVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250,\nCVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257,\nCVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262,\nCVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269,\nCVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278,\nCVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283,\nCVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290,\nCVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298,\nCVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304,\nCVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312,\nCVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321,\nCVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326,\nCVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333,\nCVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337,\nCVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344,\nCVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,\nCVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361,\nCVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365,\nCVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373,\nCVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377,\nCVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386,\nCVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390,\nCVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395,\nCVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401,\nCVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406,\nCVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410,\nCVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416,\nCVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422,\nCVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428,\nCVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437,\nCVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444,\nCVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455,\nCVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459,\nCVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463,\nCVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467,\nCVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471,\nCVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476,\nCVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482,\nCVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488,\nCVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493,\nCVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,\nCVE-2025-38499, CVE-2025-38501, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38560,\nCVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569,\nCVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,\nCVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581,\nCVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585,\nCVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593,\nCVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,\nCVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612,\nCVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622,\nCVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626,\nCVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635,\nCVE-2025-38639, CVE-2025-38640, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683,\nCVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687,\nCVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693,\nCVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,\nCVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701,\nCVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705,\nCVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,\nCVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,\nCVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694,\nCVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705,\nCVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710,\nCVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714,\nCVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719,\nCVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726,\nCVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734,\nCVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739,\nCVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746,\nCVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750,\nCVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757,\nCVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761,\nCVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772,\nCVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781,\nCVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,\nCVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797,\nCVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39889,\nCVE-2025-39890, CVE-2025-39946, CVE-2025-39989, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-02-24T18:57:40Z","modified":"2026-11-03T14:35:11.403018594Z","updated_at":"2026-11-03T15:16:30.201391Z"},{"id":"USN-8074-1","title":"linux-azure vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37956, CVE-2025-37957,\nCVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37962,\nCVE-2025-37963, CVE-2025-37967, CVE-2025-37968, CVE-2025-37969,\nCVE-2025-37970, CVE-2025-37972, CVE-2025-37973, CVE-2025-37975,\nCVE-2025-37977, CVE-2025-37978, CVE-2025-37979, CVE-2025-37980,\nCVE-2025-37982, CVE-2025-37983, CVE-2025-37984, CVE-2025-37985,\nCVE-2025-37986, CVE-2025-37987, CVE-2025-37988, CVE-2025-37989,\nCVE-2025-37990, CVE-2025-37991, CVE-2025-37992, CVE-2025-37994,\nCVE-2025-37995, CVE-2025-37998, CVE-2025-38003, CVE-2025-38004,\nCVE-2025-38005, CVE-2025-38006, CVE-2025-38007, CVE-2025-38008,\nCVE-2025-38009, CVE-2025-38010, CVE-2025-38011, CVE-2025-38013,\nCVE-2025-38014, CVE-2025-38015, CVE-2025-38018, CVE-2025-38019,\nCVE-2025-38020, CVE-2025-38023, CVE-2025-38024, CVE-2025-38027,\nCVE-2025-38031, CVE-2025-38034, CVE-2025-38035, CVE-2025-38037,\nCVE-2025-38039, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044,\nCVE-2025-38045, CVE-2025-38048, CVE-2025-38051, CVE-2025-38052,\nCVE-2025-38053, CVE-2025-38055, CVE-2025-38057, CVE-2025-38058,\nCVE-2025-38059, CVE-2025-38060, CVE-2025-38061, CVE-2025-38062,\nCVE-2025-38063, CVE-2025-38065, CVE-2025-38066, CVE-2025-38067,\nCVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074,\nCVE-2025-38075, CVE-2025-38077, CVE-2025-38078, CVE-2025-38079,\nCVE-2025-38080, CVE-2025-38081, CVE-2025-38084, CVE-2025-38085,\nCVE-2025-38086, CVE-2025-38087, CVE-2025-38088, CVE-2025-38089,\nCVE-2025-38090, CVE-2025-38094, CVE-2025-38095, CVE-2025-38097,\nCVE-2025-38098, CVE-2025-38099, CVE-2025-38100, CVE-2025-38101,\nCVE-2025-38102, CVE-2025-38103, CVE-2025-38104, CVE-2025-38107,\nCVE-2025-38108, CVE-2025-38109, CVE-2025-38110, CVE-2025-38111,\nCVE-2025-38112, CVE-2025-38113, CVE-2025-38115, CVE-2025-38117,\nCVE-2025-38119, CVE-2025-38120, CVE-2025-38122, CVE-2025-38123,\nCVE-2025-38124, CVE-2025-38125, CVE-2025-38126, CVE-2025-38127,\nCVE-2025-38129, CVE-2025-38131, CVE-2025-38135, CVE-2025-38136,\nCVE-2025-38138, CVE-2025-38142, CVE-2025-38143, CVE-2025-38145,\nCVE-2025-38146, CVE-2025-38147, CVE-2025-38148, CVE-2025-38149,\nCVE-2025-38153, CVE-2025-38154, CVE-2025-38155, CVE-2025-38156,\nCVE-2025-38157, CVE-2025-38158, CVE-2025-38159, CVE-2025-38160,\nCVE-2025-38161, CVE-2025-38162, CVE-2025-38163, CVE-2025-38164,\nCVE-2025-38165, CVE-2025-38166, CVE-2025-38167, CVE-2025-38169,\nCVE-2025-38170, CVE-2025-38173, CVE-2025-38174, CVE-2025-38180,\nCVE-2025-38181, CVE-2025-38182, CVE-2025-38183, CVE-2025-38184,\nCVE-2025-38185, CVE-2025-38190, CVE-2025-38191, CVE-2025-38192,\nCVE-2025-38193, CVE-2025-38194, CVE-2025-38197, CVE-2025-38198,\nCVE-2025-38200, CVE-2025-38202, CVE-2025-38208, CVE-2025-38210,\nCVE-2025-38211, CVE-2025-38212, CVE-2025-38214, CVE-2025-38215,\nCVE-2025-38217, CVE-2025-38218, CVE-2025-38219, CVE-2025-38220,\nCVE-2025-38222, CVE-2025-38225, CVE-2025-38226, CVE-2025-38229,\nCVE-2025-38230, CVE-2025-38231, CVE-2025-38232, CVE-2025-38236,\nCVE-2025-38239, CVE-2025-38245, CVE-2025-38246, CVE-2025-38248,\nCVE-2025-38249, CVE-2025-38250, CVE-2025-38251, CVE-2025-38253,\nCVE-2025-38255, CVE-2025-38257, CVE-2025-38258, CVE-2025-38259,\nCVE-2025-38260, CVE-2025-38262, CVE-2025-38263, CVE-2025-38264,\nCVE-2025-38265, CVE-2025-38269, CVE-2025-38274, CVE-2025-38275,\nCVE-2025-38277, CVE-2025-38278, CVE-2025-38279, CVE-2025-38280,\nCVE-2025-38282, CVE-2025-38283, CVE-2025-38285, CVE-2025-38286,\nCVE-2025-38289, CVE-2025-38290, CVE-2025-38292, CVE-2025-38293,\nCVE-2025-38295, CVE-2025-38298, CVE-2025-38299, CVE-2025-38300,\nCVE-2025-38303, CVE-2025-38304, CVE-2025-38305, CVE-2025-38307,\nCVE-2025-38310, CVE-2025-38312, CVE-2025-38313, CVE-2025-38319,\nCVE-2025-38320, CVE-2025-38321, CVE-2025-38322, CVE-2025-38323,\nCVE-2025-38324, CVE-2025-38326, CVE-2025-38328, CVE-2025-38331,\nCVE-2025-38332, CVE-2025-38333, CVE-2025-38334, CVE-2025-38335,\nCVE-2025-38336, CVE-2025-38337, CVE-2025-38338, CVE-2025-38342,\nCVE-2025-38343, CVE-2025-38344, CVE-2025-38345, CVE-2025-38346,\nCVE-2025-38347, CVE-2025-38348, CVE-2025-38349, CVE-2025-38351,\nCVE-2025-38354, CVE-2025-38361, CVE-2025-38362, CVE-2025-38363,\nCVE-2025-38364, CVE-2025-38365, CVE-2025-38368, CVE-2025-38369,\nCVE-2025-38371, CVE-2025-38373, CVE-2025-38374, CVE-2025-38375,\nCVE-2025-38376, CVE-2025-38377, CVE-2025-38382, CVE-2025-38384,\nCVE-2025-38385, CVE-2025-38386, CVE-2025-38387, CVE-2025-38388,\nCVE-2025-38389, CVE-2025-38390, CVE-2025-38391, CVE-2025-38392,\nCVE-2025-38393, CVE-2025-38395, CVE-2025-38396, CVE-2025-38399,\nCVE-2025-38400, CVE-2025-38401, CVE-2025-38402, CVE-2025-38403,\nCVE-2025-38405, CVE-2025-38406, CVE-2025-38407, CVE-2025-38408,\nCVE-2025-38409, CVE-2025-38410, CVE-2025-38412, CVE-2025-38414,\nCVE-2025-38415, CVE-2025-38416, CVE-2025-38418, CVE-2025-38419,\nCVE-2025-38420, CVE-2025-38422, CVE-2025-38424, CVE-2025-38425,\nCVE-2025-38427, CVE-2025-38428, CVE-2025-38429, CVE-2025-38430,\nCVE-2025-38436, CVE-2025-38437, CVE-2025-38439, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38448,\nCVE-2025-38449, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457,\nCVE-2025-38458, CVE-2025-38459, CVE-2025-38460, CVE-2025-38461,\nCVE-2025-38462, CVE-2025-38463, CVE-2025-38464, CVE-2025-38465,\nCVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469,\nCVE-2025-38470, CVE-2025-38471, CVE-2025-38472, CVE-2025-38473,\nCVE-2025-38474, CVE-2025-38476, CVE-2025-38478, CVE-2025-38480,\nCVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495,\nCVE-2025-38496, CVE-2025-38497, CVE-2025-38499, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38506, CVE-2025-38507, CVE-2025-38510,\nCVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,\nCVE-2025-38515, CVE-2025-38516, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528,\nCVE-2025-38529, CVE-2025-38530, CVE-2025-38531, CVE-2025-38532,\nCVE-2025-38533, CVE-2025-38535, CVE-2025-38537, CVE-2025-38538,\nCVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543,\nCVE-2025-38544, CVE-2025-38546, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38566, CVE-2025-38568, CVE-2025-38569, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,\nCVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582,\nCVE-2025-38583, CVE-2025-38584, CVE-2025-38585, CVE-2025-38587,\nCVE-2025-38588, CVE-2025-38590, CVE-2025-38593, CVE-2025-38595,\nCVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38608,\nCVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38614,\nCVE-2025-38615, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623,\nCVE-2025-38624, CVE-2025-38625, CVE-2025-38626, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38644, CVE-2025-38645, CVE-2025-38646,\nCVE-2025-38648, CVE-2025-38650, CVE-2025-38652, CVE-2025-38653,\nCVE-2025-38659, CVE-2025-38660, CVE-2025-38663, CVE-2025-38664,\nCVE-2025-38665, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671,\nCVE-2025-38675, CVE-2025-38676, CVE-2025-38677, CVE-2025-38679,\nCVE-2025-38680, CVE-2025-38681, CVE-2025-38684, CVE-2025-38685,\nCVE-2025-38686, CVE-2025-38687, CVE-2025-38688, CVE-2025-38691,\nCVE-2025-38692, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695,\nCVE-2025-38696, CVE-2025-38697, CVE-2025-38698, CVE-2025-38699,\nCVE-2025-38700, CVE-2025-38701, CVE-2025-38702, CVE-2025-38703,\nCVE-2025-38704, CVE-2025-38705, CVE-2025-38706, CVE-2025-38707,\nCVE-2025-38708, CVE-2025-38710, CVE-2025-38711, CVE-2025-38712,\nCVE-2025-38713, CVE-2025-38714, CVE-2025-38715, CVE-2025-38716,\nCVE-2025-38718, CVE-2025-38721, CVE-2025-38722, CVE-2025-38724,\nCVE-2025-38725, CVE-2025-38728, CVE-2025-38729, CVE-2025-38730,\nCVE-2025-38732, CVE-2025-38734, CVE-2025-38735, CVE-2025-39673,\nCVE-2025-39675, CVE-2025-39676, CVE-2025-39679, CVE-2025-39681,\nCVE-2025-39683, CVE-2025-39684, CVE-2025-39685, CVE-2025-39686,\nCVE-2025-39687, CVE-2025-39689, CVE-2025-39691, CVE-2025-39692,\nCVE-2025-39693, CVE-2025-39694, CVE-2025-39698, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39889, CVE-2025-39890,\nCVE-2025-39946, CVE-2025-39989, CVE-2025-40019, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-03-04T15:34:29Z","modified":"2026-11-03T14:35:09.454915937Z","updated_at":"2026-11-03T15:16:30.201391Z"},{"id":"USN-8074-2","title":"linux-azure-fips vulnerabilities","description":"It was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Amlogic Meson DDR PMU;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Overlay file system;\n  - Proc file system;\n  - SMB network file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - padata parallel execution mechanism;\n  - Networking subsytem;\n  - Bluetooth subsystem;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Perf events;\n  - Kernel exit() syscall;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Maple Tree data structure library;\n  - Memory management;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22101,\nCVE-2025-22102, CVE-2025-22115, CVE-2025-22120, CVE-2025-22126,\nCVE-2025-22128, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142,\nCVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147,\nCVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151,\nCVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158,\nCVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163,\nCVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741,\nCVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748,\nCVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757,\nCVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763,\nCVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767,\nCVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771,\nCVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777,\nCVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784,\nCVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789,\nCVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794,\nCVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801,\nCVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809,\nCVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813,\nCVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819,\nCVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824,\nCVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829,\nCVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839,\nCVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844,\nCVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851,\nCVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856,\nCVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37861,\nCVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865,\nCVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872,\nCVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878,\nCVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884,\nCVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891,\nCVE-2025-37892, CVE-2025-37897, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37956, CVE-2025-37957,\nCVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37962,\nCVE-2025-37963, CVE-2025-37967, CVE-2025-37968, CVE-2025-37969,\nCVE-2025-37970, CVE-2025-37972, CVE-2025-37973, CVE-2025-37975,\nCVE-2025-37977, CVE-2025-37978, CVE-2025-37979, CVE-2025-37980,\nCVE-2025-37982, CVE-2025-37983, CVE-2025-37984, CVE-2025-37985,\nCVE-2025-37986, CVE-2025-37987, CVE-2025-37988, CVE-2025-37989,\nCVE-2025-37990, CVE-2025-37991, CVE-2025-37992, CVE-2025-37994,\nCVE-2025-37995, CVE-2025-37998, CVE-2025-38003, CVE-2025-38004,\nCVE-2025-38005, CVE-2025-38006, CVE-2025-38007, CVE-2025-38008,\nCVE-2025-38009, CVE-2025-38010, CVE-2025-38011, CVE-2025-38013,\nCVE-2025-38014, CVE-2025-38015, CVE-2025-38018, CVE-2025-38019,\nCVE-2025-38020, CVE-2025-38023, CVE-2025-38024, CVE-2025-38027,\nCVE-2025-38031, CVE-2025-38034, CVE-2025-38035, CVE-2025-38037,\nCVE-2025-38039, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044,\nCVE-2025-38045, CVE-2025-38048, CVE-2025-38051, CVE-2025-38052,\nCVE-2025-38053, CVE-2025-38055, CVE-2025-38057, CVE-2025-38058,\nCVE-2025-38059, CVE-2025-38060, CVE-2025-38061, CVE-2025-38062,\nCVE-2025-38063, CVE-2025-38065, CVE-2025-38066, CVE-2025-38067,\nCVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074,\nCVE-2025-38075, CVE-2025-38077, CVE-2025-38078, CVE-2025-38079,\nCVE-2025-38080, CVE-2025-38081, CVE-2025-38084, CVE-2025-38085,\nCVE-2025-38086, CVE-2025-38087, CVE-2025-38088, CVE-2025-38089,\nCVE-2025-38090, CVE-2025-38094, CVE-2025-38095, CVE-2025-38097,\nCVE-2025-38098, CVE-2025-38099, CVE-2025-38100, CVE-2025-38101,\nCVE-2025-38102, CVE-2025-38103, CVE-2025-38104, CVE-2025-38107,\nCVE-2025-38108, CVE-2025-38109, CVE-2025-38110, CVE-2025-38111,\nCVE-2025-38112, CVE-2025-38113, CVE-2025-38115, CVE-2025-38117,\nCVE-2025-38119, CVE-2025-38120, CVE-2025-38122, CVE-2025-38123,\nCVE-2025-38124, CVE-2025-38125, CVE-2025-38126, CVE-2025-38127,\nCVE-2025-38129, CVE-2025-38131, CVE-2025-38135, CVE-2025-38136,\nCVE-2025-38138, CVE-2025-38142, CVE-2025-38143, CVE-2025-38145,\nCVE-2025-38146, CVE-2025-38147, CVE-2025-38148, CVE-2025-38149,\nCVE-2025-38153, CVE-2025-38154, CVE-2025-38155, CVE-2025-38156,\nCVE-2025-38157, CVE-2025-38158, CVE-2025-38159, CVE-2025-38160,\nCVE-2025-38161, CVE-2025-38162, CVE-2025-38163, CVE-2025-38164,\nCVE-2025-38165, CVE-2025-38166, CVE-2025-38167, CVE-2025-38169,\nCVE-2025-38170, CVE-2025-38173, CVE-2025-38174, CVE-2025-38180,\nCVE-2025-38181, CVE-2025-38182, CVE-2025-38183, CVE-2025-38184,\nCVE-2025-38185, CVE-2025-38190, CVE-2025-38191, CVE-2025-38192,\nCVE-2025-38193, CVE-2025-38194, CVE-2025-38197, CVE-2025-38198,\nCVE-2025-38200, CVE-2025-38202, CVE-2025-38208, CVE-2025-38210,\nCVE-2025-38211, CVE-2025-38212, CVE-2025-38214, CVE-2025-38215,\nCVE-2025-38217, CVE-2025-38218, CVE-2025-38219, CVE-2025-38220,\nCVE-2025-38222, CVE-2025-38225, CVE-2025-38226, CVE-2025-38229,\nCVE-2025-38230, CVE-2025-38231, CVE-2025-38232, CVE-2025-38236,\nCVE-2025-38239, CVE-2025-38245, CVE-2025-38246, CVE-2025-38248,\nCVE-2025-38249, CVE-2025-38250, CVE-2025-38251, CVE-2025-38253,\nCVE-2025-38255, CVE-2025-38257, CVE-2025-38258, CVE-2025-38259,\nCVE-2025-38260, CVE-2025-38262, CVE-2025-38263, CVE-2025-38264,\nCVE-2025-38265, CVE-2025-38269, CVE-2025-38274, CVE-2025-38275,\nCVE-2025-38277, CVE-2025-38278, CVE-2025-38279, CVE-2025-38280,\nCVE-2025-38282, CVE-2025-38283, CVE-2025-38285, CVE-2025-38286,\nCVE-2025-38289, CVE-2025-38290, CVE-2025-38292, CVE-2025-38293,\nCVE-2025-38295, CVE-2025-38298, CVE-2025-38299, CVE-2025-38300,\nCVE-2025-38303, CVE-2025-38304, CVE-2025-38305, CVE-2025-38307,\nCVE-2025-38310, CVE-2025-38312, CVE-2025-38313, CVE-2025-38319,\nCVE-2025-38320, CVE-2025-38321, CVE-2025-38322, CVE-2025-38323,\nCVE-2025-38324, CVE-2025-38326, CVE-2025-38328, CVE-2025-38331,\nCVE-2025-38332, CVE-2025-38333, CVE-2025-38334, CVE-2025-38335,\nCVE-2025-38336, CVE-2025-38337, CVE-2025-38338, CVE-2025-38342,\nCVE-2025-38343, CVE-2025-38344, CVE-2025-38345, CVE-2025-38346,\nCVE-2025-38347, CVE-2025-38348, CVE-2025-38349, CVE-2025-38351,\nCVE-2025-38354, CVE-2025-38361, CVE-2025-38362, CVE-2025-38363,\nCVE-2025-38364, CVE-2025-38365, CVE-2025-38368, CVE-2025-38369,\nCVE-2025-38371, CVE-2025-38373, CVE-2025-38374, CVE-2025-38375,\nCVE-2025-38376, CVE-2025-38377, CVE-2025-38382, CVE-2025-38384,\nCVE-2025-38385, CVE-2025-38386, CVE-2025-38387, CVE-2025-38388,\nCVE-2025-38389, CVE-2025-38390, CVE-2025-38391, CVE-2025-38392,\nCVE-2025-38393, CVE-2025-38395, CVE-2025-38396, CVE-2025-38399,\nCVE-2025-38400, CVE-2025-38401, CVE-2025-38402, CVE-2025-38403,\nCVE-2025-38405, CVE-2025-38406, CVE-2025-38407, CVE-2025-38408,\nCVE-2025-38409, CVE-2025-38410, CVE-2025-38412, CVE-2025-38414,\nCVE-2025-38415, CVE-2025-38416, CVE-2025-38418, CVE-2025-38419,\nCVE-2025-38420, CVE-2025-38422, CVE-2025-38424, CVE-2025-38425,\nCVE-2025-38427, CVE-2025-38428, CVE-2025-38429, CVE-2025-38430,\nCVE-2025-38436, CVE-2025-38437, CVE-2025-38439, CVE-2025-38441,\nCVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38448,\nCVE-2025-38449, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457,\nCVE-2025-38458, CVE-2025-38459, CVE-2025-38460, CVE-2025-38461,\nCVE-2025-38462, CVE-2025-38463, CVE-2025-38464, CVE-2025-38465,\nCVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469,\nCVE-2025-38470, CVE-2025-38471, CVE-2025-38472, CVE-2025-38473,\nCVE-2025-38474, CVE-2025-38476, CVE-2025-38478, CVE-2025-38480,\nCVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38485,\nCVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490,\nCVE-2025-38491, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495,\nCVE-2025-38496, CVE-2025-38497, CVE-2025-38499, CVE-2025-38501,\nCVE-2025-38503, CVE-2025-38506, CVE-2025-38507, CVE-2025-38510,\nCVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,\nCVE-2025-38515, CVE-2025-38516, CVE-2025-38520, CVE-2025-38521,\nCVE-2025-38524, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528,\nCVE-2025-38529, CVE-2025-38530, CVE-2025-38531, CVE-2025-38532,\nCVE-2025-38533, CVE-2025-38535, CVE-2025-38537, CVE-2025-38538,\nCVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543,\nCVE-2025-38544, CVE-2025-38546, CVE-2025-38548, CVE-2025-38549,\nCVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553,\nCVE-2025-38555, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562,\nCVE-2025-38566, CVE-2025-38568, CVE-2025-38569, CVE-2025-38571,\nCVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,\nCVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582,\nCVE-2025-38583, CVE-2025-38584, CVE-2025-38585, CVE-2025-38587,\nCVE-2025-38588, CVE-2025-38590, CVE-2025-38593, CVE-2025-38595,\nCVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38608,\nCVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38614,\nCVE-2025-38615, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623,\nCVE-2025-38624, CVE-2025-38625, CVE-2025-38626, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38644, CVE-2025-38645, CVE-2025-38646,\nCVE-2025-38648, CVE-2025-38650, CVE-2025-38652, CVE-2025-38653,\nCVE-2025-38659, CVE-2025-38660, CVE-2025-38663, CVE-2025-38664,\nCVE-2025-38665, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671,\nCVE-2025-38675, CVE-2025-38676, CVE-2025-38677, CVE-2025-38679,\nCVE-2025-38680, CVE-2025-38681, CVE-2025-38684, CVE-2025-38685,\nCVE-2025-38686, CVE-2025-38687, CVE-2025-38688, CVE-2025-38691,\nCVE-2025-38692, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695,\nCVE-2025-38696, CVE-2025-38697, CVE-2025-38698, CVE-2025-38699,\nCVE-2025-38700, CVE-2025-38701, CVE-2025-38702, CVE-2025-38703,\nCVE-2025-38704, CVE-2025-38705, CVE-2025-38706, CVE-2025-38707,\nCVE-2025-38708, CVE-2025-38710, CVE-2025-38711, CVE-2025-38712,\nCVE-2025-38713, CVE-2025-38714, CVE-2025-38715, CVE-2025-38716,\nCVE-2025-38718, CVE-2025-38721, CVE-2025-38722, CVE-2025-38724,\nCVE-2025-38725, CVE-2025-38728, CVE-2025-38729, CVE-2025-38730,\nCVE-2025-38732, CVE-2025-38734, CVE-2025-38735, CVE-2025-39673,\nCVE-2025-39675, CVE-2025-39676, CVE-2025-39679, CVE-2025-39681,\nCVE-2025-39683, CVE-2025-39684, CVE-2025-39685, CVE-2025-39686,\nCVE-2025-39687, CVE-2025-39689, CVE-2025-39691, CVE-2025-39692,\nCVE-2025-39693, CVE-2025-39694, CVE-2025-39698, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39889, CVE-2025-39890,\nCVE-2025-39946, CVE-2025-39989, CVE-2025-40019, CVE-2025-40215,\nCVE-2025-40297, CVE-2025-68750)\n","status":"published","published":"2026-03-04T15:48:10Z","modified":"2026-11-03T14:35:09.926921525Z","updated_at":"2026-11-03T15:16:30.201391Z"},{"id":"USN-8126-1","title":"linux-azure-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Block device driver;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Amlogic Meson DDR PMU;\n  - Performance monitor drivers;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFFS2 file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - padata parallel execution mechanism;\n  - Memory management;\n  - Networking subsytem;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Network traffic control;\n  - Rose network layer;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - PID allocator;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Maple Tree data structure library;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - RF switch subsystem;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21833, CVE-2025-21884, CVE-2025-21931, CVE-2025-22026,\nCVE-2025-22037, CVE-2025-22101, CVE-2025-22102, CVE-2025-22103,\nCVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113,\nCVE-2025-22115, CVE-2025-22120, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-22126, CVE-2025-22128, CVE-2025-23129,\nCVE-2025-23130, CVE-2025-23133, CVE-2025-23140, CVE-2025-23141,\nCVE-2025-23142, CVE-2025-23143, CVE-2025-23144, CVE-2025-23145,\nCVE-2025-23146, CVE-2025-23147, CVE-2025-23148, CVE-2025-23149,\nCVE-2025-23150, CVE-2025-23151, CVE-2025-23155, CVE-2025-23156,\nCVE-2025-23157, CVE-2025-23158, CVE-2025-23159, CVE-2025-23160,\nCVE-2025-23161, CVE-2025-23163, CVE-2025-37738, CVE-2025-37739,\nCVE-2025-37740, CVE-2025-37741, CVE-2025-37742, CVE-2025-37744,\nCVE-2025-37745, CVE-2025-37748, CVE-2025-37749, CVE-2025-37754,\nCVE-2025-37755, CVE-2025-37757, CVE-2025-37758, CVE-2025-37759,\nCVE-2025-37761, CVE-2025-37763, CVE-2025-37764, CVE-2025-37765,\nCVE-2025-37766, CVE-2025-37767, CVE-2025-37768, CVE-2025-37769,\nCVE-2025-37770, CVE-2025-37771, CVE-2025-37772, CVE-2025-37773,\nCVE-2025-37775, CVE-2025-37777, CVE-2025-37778, CVE-2025-37780,\nCVE-2025-37781, CVE-2025-37784, CVE-2025-37786, CVE-2025-37787,\nCVE-2025-37788, CVE-2025-37789, CVE-2025-37790, CVE-2025-37792,\nCVE-2025-37793, CVE-2025-37794, CVE-2025-37796, CVE-2025-37799,\nCVE-2025-37800, CVE-2025-37801, CVE-2025-37803, CVE-2025-37805,\nCVE-2025-37808, CVE-2025-37809, CVE-2025-37810, CVE-2025-37811,\nCVE-2025-37812, CVE-2025-37813, CVE-2025-37815, CVE-2025-37816,\nCVE-2025-37817, CVE-2025-37819, CVE-2025-37820, CVE-2025-37822,\nCVE-2025-37823, CVE-2025-37824, CVE-2025-37826, CVE-2025-37827,\nCVE-2025-37828, CVE-2025-37829, CVE-2025-37830, CVE-2025-37831,\nCVE-2025-37836, CVE-2025-37839, CVE-2025-37840, CVE-2025-37841,\nCVE-2025-37842, CVE-2025-37844, CVE-2025-37846, CVE-2025-37849,\nCVE-2025-37850, CVE-2025-37851, CVE-2025-37852, CVE-2025-37853,\nCVE-2025-37854, CVE-2025-37856, CVE-2025-37857, CVE-2025-37858,\nCVE-2025-37859, CVE-2025-37860, CVE-2025-37861, CVE-2025-37862,\nCVE-2025-37863, CVE-2025-37864, CVE-2025-37865, CVE-2025-37867,\nCVE-2025-37869, CVE-2025-37871, CVE-2025-37872, CVE-2025-37873,\nCVE-2025-37874, CVE-2025-37875, CVE-2025-37878, CVE-2025-37879,\nCVE-2025-37881, CVE-2025-37883, CVE-2025-37884, CVE-2025-37885,\nCVE-2025-37886, CVE-2025-37887, CVE-2025-37891, CVE-2025-37892,\nCVE-2025-37897, CVE-2025-37899, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37956, CVE-2025-37957,\nCVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37962,\nCVE-2025-37963, CVE-2025-37967, CVE-2025-37968, CVE-2025-37969,\nCVE-2025-37970, CVE-2025-37972, CVE-2025-37973, CVE-2025-37975,\nCVE-2025-37977, CVE-2025-37978, CVE-2025-37979, CVE-2025-37980,\nCVE-2025-37982, CVE-2025-37983, CVE-2025-37984, CVE-2025-37985,\nCVE-2025-37986, CVE-2025-37987, CVE-2025-37988, CVE-2025-37989,\nCVE-2025-37990, CVE-2025-37991, CVE-2025-37992, CVE-2025-37994,\nCVE-2025-37995, CVE-2025-37998, CVE-2025-38003, CVE-2025-38004,\nCVE-2025-38005, CVE-2025-38006, CVE-2025-38007, CVE-2025-38008,\nCVE-2025-38009, CVE-2025-38010, CVE-2025-38011, CVE-2025-38013,\nCVE-2025-38014, CVE-2025-38015, CVE-2025-38018, CVE-2025-38019,\nCVE-2025-38020, CVE-2025-38023, CVE-2025-38024, CVE-2025-38027,\nCVE-2025-38031, CVE-2025-38034, CVE-2025-38035, CVE-2025-38037,\nCVE-2025-38039, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044,\nCVE-2025-38045, CVE-2025-38048, CVE-2025-38051, CVE-2025-38052,\nCVE-2025-38053, CVE-2025-38055, CVE-2025-38057, CVE-2025-38058,\nCVE-2025-38059, CVE-2025-38060, CVE-2025-38061, CVE-2025-38062,\nCVE-2025-38063, CVE-2025-38065, CVE-2025-38066, CVE-2025-38067,\nCVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074,\nCVE-2025-38075, CVE-2025-38077, CVE-2025-38078, CVE-2025-38079,\nCVE-2025-38080, CVE-2025-38081, CVE-2025-38084, CVE-2025-38085,\nCVE-2025-38086, CVE-2025-38087, CVE-2025-38088, CVE-2025-38089,\nCVE-2025-38090, CVE-2025-38094, CVE-2025-38095, CVE-2025-38097,\nCVE-2025-38098, CVE-2025-38099, CVE-2025-38100, CVE-2025-38101,\nCVE-2025-38102, CVE-2025-38103, CVE-2025-38104, CVE-2025-38105,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38245, CVE-2025-38246,\nCVE-2025-38248, CVE-2025-38249, CVE-2025-38250, CVE-2025-38251,\nCVE-2025-38253, CVE-2025-38255, CVE-2025-38257, CVE-2025-38258,\nCVE-2025-38259, CVE-2025-38260, CVE-2025-38262, CVE-2025-38263,\nCVE-2025-38264, CVE-2025-38265, CVE-2025-38269, CVE-2025-38274,\nCVE-2025-38275, CVE-2025-38277, CVE-2025-38278, CVE-2025-38279,\nCVE-2025-38280, CVE-2025-38282, CVE-2025-38283, CVE-2025-38285,\nCVE-2025-38286, CVE-2025-38289, CVE-2025-38290, CVE-2025-38292,\nCVE-2025-38293, CVE-2025-38295, CVE-2025-38298, CVE-2025-38299,\nCVE-2025-38300, CVE-2025-38303, CVE-2025-38304, CVE-2025-38305,\nCVE-2025-38307, CVE-2025-38310, CVE-2025-38312, CVE-2025-38313,\nCVE-2025-38319, CVE-2025-38320, CVE-2025-38321, CVE-2025-38322,\nCVE-2025-38323, CVE-2025-38324, CVE-2025-38326, CVE-2025-38328,\nCVE-2025-38331, CVE-2025-38332, CVE-2025-38333, CVE-2025-38334,\nCVE-2025-38335, CVE-2025-38336, CVE-2025-38337, CVE-2025-38338,\nCVE-2025-38342, CVE-2025-38343, CVE-2025-38344, CVE-2025-38345,\nCVE-2025-38346, CVE-2025-38347, CVE-2025-38348, CVE-2025-38349,\nCVE-2025-38351, CVE-2025-38354, CVE-2025-38361, CVE-2025-38362,\nCVE-2025-38363, CVE-2025-38364, CVE-2025-38365, CVE-2025-38368,\nCVE-2025-38369, CVE-2025-38371, CVE-2025-38373, CVE-2025-38374,\nCVE-2025-38375, CVE-2025-38376, CVE-2025-38377, CVE-2025-38382,\nCVE-2025-38384, CVE-2025-38385, CVE-2025-38386, CVE-2025-38387,\nCVE-2025-38388, CVE-2025-38389, CVE-2025-38390, CVE-2025-38391,\nCVE-2025-38392, CVE-2025-38393, CVE-2025-38395, CVE-2025-38396,\nCVE-2025-38399, CVE-2025-38400, CVE-2025-38401, CVE-2025-38402,\nCVE-2025-38403, CVE-2025-38405, CVE-2025-38406, CVE-2025-38407,\nCVE-2025-38408, CVE-2025-38409, CVE-2025-38410, CVE-2025-38412,\nCVE-2025-38414, CVE-2025-38415, CVE-2025-38416, CVE-2025-38418,\nCVE-2025-38419, CVE-2025-38420, CVE-2025-38422, CVE-2025-38424,\nCVE-2025-38425, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429,\nCVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439,\nCVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456,\nCVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460,\nCVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,\nCVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468,\nCVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472,\nCVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478,\nCVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,\nCVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489,\nCVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499,\nCVE-2025-38501, CVE-2025-38502, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556,\nCVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38566,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38571, CVE-2025-38572,\nCVE-2025-38574, CVE-2025-38576, CVE-2025-38577, CVE-2025-38578,\nCVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583,\nCVE-2025-38584, CVE-2025-38585, CVE-2025-38587, CVE-2025-38588,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609,\nCVE-2025-38610, CVE-2025-38612, CVE-2025-38614, CVE-2025-38615,\nCVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624,\nCVE-2025-38625, CVE-2025-38626, CVE-2025-38627, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38643, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38684,\nCVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688,\nCVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694,\nCVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698,\nCVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702,\nCVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706,\nCVE-2025-38707, CVE-2025-38708, CVE-2025-38709, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39678, CVE-2025-39679, CVE-2025-39681, CVE-2025-39683,\nCVE-2025-39684, CVE-2025-39685, CVE-2025-39686, CVE-2025-39687,\nCVE-2025-39689, CVE-2025-39691, CVE-2025-39692, CVE-2025-39693,\nCVE-2025-39694, CVE-2025-39697, CVE-2025-39698, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39889, CVE-2025-39890, CVE-2025-39891,\nCVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899,\nCVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909,\nCVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916,\nCVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929,\nCVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937,\nCVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943,\nCVE-2025-39944, CVE-2025-39945, CVE-2025-39946, CVE-2025-39947,\nCVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951,\nCVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957,\nCVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968,\nCVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972,\nCVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980,\nCVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986,\nCVE-2025-39987, CVE-2025-39988, CVE-2025-39989, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40019, CVE-2025-40020,\nCVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037,\nCVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044,\nCVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051,\nCVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056,\nCVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,\nCVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078,\nCVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083,\nCVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101,\nCVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,\nCVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111,\nCVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124,\nCVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129,\nCVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141,\nCVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,\nCVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166,\nCVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172,\nCVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40211, CVE-2025-40215, CVE-2025-40218, CVE-2025-40219,\nCVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237,\nCVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250,\nCVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254,\nCVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,\nCVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272,\nCVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40297, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2025-68750)\n","status":"published","published":"2026-03-25T19:13:52Z","modified":"2026-11-03T14:35:29.863770912Z","updated_at":"2026-11-03T15:16:14.724953Z"}]}}